Add checksum support for Platform RPMs

[mazam32-itential]

Summary

• Some customers require RPM checksums to be validated before install. Added an optional checksum parameter to the get_url task in roles/platform/tasks/download-platform-archive-from-repo.yml that downloads Platform RPMs from a repository (Nexus/JFrog/etc.).
• The checksum value is sourced from a new platform_package_checksums dict (default {}), keyed by the exact download URL, added to roles/platform/defaults/main/platform.yml.
• URLs with no matching entry in platform_package_checksums are downloaded without verification — fully backward compatible, opt-in only.
• Scope: only the repository-download (get_url) path is affected, per the ticket. The local/manual-upload path uses the copy module, which has no checksum parameter — out of scope here.
• Updated docs/itential_platform_guide.md and roles/platform/CLAUDE.md to document the new variable.

How this was tested

Tested end-to-end against a live EC2 instance (Rocky Linux 9, AIO topology), using the real Itential Platform 6.5.1 RPM from Nexus and its officially published .sha256 checksum (Nexus publishes .sha256 files alongside newer Platform RPM releases).

Positive test — platform_package_checksums set to the real published checksum:

platform_package_checksums:
  "https://registry.aws.itential.com/repository/PLATFORM/Platform%206/Platform%206.5.1/itential-platform-6.5.1-1.noarch.rpm": "sha256:440353320215dcc737184744579362d78400da0bc46839fa4f6d220129843531"

Ran ansible-playbook itential.deployer.platform -i inventories/aio/hosts.yaml --tags platform_install. Result: download task succeeded ("msg": "OK (134380937 bytes)", status_code: 200), Platform installed, itential-platform.service came up active.

Negative test — same run, only the checksum value changed to a deliberately wrong all-zero string. Result: the download task failed immediately:

"msg": "The checksum for /tmp/.../itential-platform-6.5.1-1.noarch.rpm did not match
0000000000000000000000000000000000000000000000000000000000000000; it was
440353320215dcc737184744579362d78400da0bc46839fa4f6d220129843531."

Play recap: failed=1 — the play stopped at the download task, before the RPM ever reached the dnf install step. Note the computed hash get_url reports in the error exactly matches the real Nexus-published checksum from the positive test, confirming this is a genuine hash-and-compare, not a no-op.

Lint: ansible-lint on both changed task/defaults files passes clean (0 failures, 0 warnings).

Test plan for reviewer

• Confirm the diff only adds the checksum: line to the get_url task and the new platform_package_checksums default (no changes to the local-file/manual-upload path)
• Optionally reproduce the positive/negative test above against any repository-hosted RPM with a known checksum
• Confirm existing inventories that don't set platform_package_checksums are unaffected (checksum is omitted, same as today)