`readium-lcp` should check the `hash` of an acquired publication

According to the LCP specification:

> Reading Systems **should** verify the integrity of the downloaded Protected Publication, if a hash is provided.
> https://readium.org/lcp-specs/releases/lcp/latest.html#acquiring-the-publication

Related: https://github.com/readium/lcp-specs/issues/52