Prepare for PQ (post-quantum) cryptography

[xsuchy]

Currently, dist-git supports only sha512sum and md5sum https://github.com/release-engineering/dist-git/blob/main/dist-git/scripts/httpd/upload.cgi#L125
For post-quantum (PQ) we need to choose whatever will be recommended to use in PQ era.

Right now, I am not aware of any recommended sha512sum successor

[xsuchy]

I asked guys from crypto team and got this answer:
Nothing to do, stay with SHA2-512.
CNSA 2.0 (the requirements document written by the NSA that mandates transition to PQC algorithms for the US government and its contractors) specifically recommends to continue to use SHA2-512 and not transition to SHA3. Their argument on this is that SHA3 does not have hardware acceleration widely available. SHA3 is only allowed in algorithms that internally use it, e.g., ML-DSA. Note that post-quantum signature algorithms often do their own hashing internally, similar to how Ed25519 can be used to sign content directly without hashing it first, because it internally does the hashing.