feat: verify archive integrity before extraction (SHA-256 checksum support)

Summary

Currently, src/main.ts downloads a release tarball via tc.downloadTool() and immediately extracts it via tc.extractTar() without verifying the archive's integrity. This weakens supply-chain security for every workflow using this action.

Background

To properly implement checksum verification in the setup-adc action, the upstream ADC release workflow must first be enhanced to:

1. Publish SHA-256 digest files alongside each release asset (e.g., adc_linux_amd64.tar.gz.sha256).
2. Enable immutable releases so that release assets cannot be silently replaced after publication.

Once the upstream project provides these artifacts, the action can be updated to:

• Fetch the expected checksum from the release metadata or a .sha256 sidecar file.
• Compute the SHA-256 digest of the downloaded archive.
• Compare the computed digest to the expected value and abort extraction if they do not match.

References

• PR: https://github.com/api7/setup-adc/pull/1
• Review comment: https://github.com/api7/setup-adc/pull/1#discussion_r3193043662

/cc @bzp2010