Signature should cover size and sha256 of uncompressed images

As an example, given the following JSON from simplestreams:

      "root-image.gz": {
       "path": "trusty/arm64/20150911/root-image.gz",
       "ftype": "root-image.gz",
       "sha256": "8466c35a1895bea7a31fb1502455871747e1821b1a7dfe27e5765dc315fdb2dc",
       "size": 303454455
      }

Note here that the sha256 covers only the *compressed* file. Once the file has been uncompressed, there is no way to validate its integrity in a trusted manner.

We should consider changing this to something like:

      "root-image.gz": {
       "path": "trusty/arm64/20150911/root-image.gz",
       "ftype": "root-image.gz",
       "sha256": "8466c35a1895bea7a31fb1502455871747e1821b1a7dfe27e5765dc315fdb2dc",
       "uncompressed_sha256": "6e03910d549413e945de384f27eeeacf11cad5d0108446aa776204fc775b6425",
       "size": 303454455
       "uncompressed_size": 1468006400
      }