Checksum for workbench download in CI

If the version of Workbench specified in the CI yaml isn't present, we'll download the file from the Workbench repo. If this download fails and produces an incomplete tarball, not only will that current CI run fail to extract Workbench into the CI folder but subsequent CI runs will fail b/c they will skip the Workbench download step due to the presence of a Workbench tarball on the CI service machine.

To solve this, the tarball checksum should be validated before unpacking it in CI. If this fails then we can either attempt the download again or present an error message that is more clear.