Use SHA256 for file checksums. SHA1 makes no sense as a default in 2023. Given that we're just looking at a file checksum to see if it's changed, this does not need to take repository's OID type into account or otherwise be configurable.
