Verify mold release checksums before installation (#20941)
## Summary
`scripts/install-mold.sh` downloaded mold from a mutable GitHub release
and piped the archive directly into `sudo tar`. A replaced release asset
could install an attacker-controlled linker before CI builds binaries
that later run with cloud and publishing credentials.
Pin reviewed SHA-256 digests for the two architectures used in CI
(`aarch64` and `x86_64`), download the archive to a temporary file, and
verify it before extraction or privileged execution. Unsupported
architectures, unreviewed versions, missing verification, and checksum
mismatches now fail closed. Updating mold requires reviewing and
updating the pinned digests.
## Test plan (on top of CI)
- Downloaded the `aarch64` and `x86_64` release archives and verified
their SHA-256 digests against the pinned values.
- Confirmed valid archives are verified before privileged extraction on
both supported CI architectures.
- Reproduced privileged extraction of attacker-controlled bytes with the
previous installer and verified the updated installer rejects them
before invoking `sudo` or `tar`.
- Confirmed unsupported architectures and unreviewed versions fail
before downloading, and missing verification or checksum mismatches fail
before privileged execution.
- Ran ShellCheck and `bash -n` against the updated installer.
Co-authored-by: Zsolt Dollenstein <zsol@openai.com>
