Prefactor package hashing (#4816)
We currently do file hashing for packages (and fallbacks) in _lots_ of
different places, making it _very_ difficult to trace through or
(more-importantly) modify the set of files whose hashes we need to
include.
This PR makes no material changes, each commit passes all of our tests.
At the end of it all of the hashing logic ends up in just one spot.
---------
Co-authored-by: Nathan Hammond <Nathan Hammond>
