build: replace MD5SUM variables with HASH

Since we've switched to preferring SHA256 over MD5, the old variable
name is misleading. Packages using the old name remain compatible.

Signed-off-by: Felix Fietkau <nbd@nbd.name>