Partially addresses googleapis/google-cloud-python#15633, majority of work done by @mfschwartz.

Current limitations:

• doesn't handle ChunkedDownload
• doesn't verify MD5 hash for a Download without a stream
• doesn't verify MD5 hash for non-requests Download
• doesn't handle case of downloading composite objects (where X-Goog-Hash only includes crc32c information)
• doesn't do anything about upload checksumming
• doesn't verify the CRC32C hash

NOTE: This was #31, but I couldn't push to it for some reason

$ git push mfschwartz pr-31:mfschwartz/master 
Counting objects: 14, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (14/14), done.
Writing objects: 100% (14/14), 5.58 KiB | 0 bytes/s, done.
Total 14 (delta 9), reused 0 (delta 0)
remote: Resolving deltas: 100% (9/9), completed with 9 local objects.
To [email protected]:mfschwartz/google-resumable-media-python.git
 ! [remote rejected] pr-31 -> mfschwartz/master (permission denied)
error: failed to push some refs to '[email protected]:mfschwartz/google-resumable-media-python.git'

It's better in the end because this branch is on the google-resumable-media remote, so it can run system tests.