reinstate the update.xml hash check

While working on legacy/trac#18912 (moved), Kathy and I discovered the following Mozilla change that causes the update.xml hash check to be skipped when signed MAR files are in use (this change shipped in Firefox 43): https://bugzilla.mozilla.org/show_bug.cgi?id=862173

I think the our philosophy is different than Mozilla's and that we probably want to reinstate the hash check. Mike and Georg, do you agree?