Instead of a git submodule allow botan-src to checkout a tag

[randombit]

Discussion in #94

For released versions, we should download the tarball, and check it against an embedded SHA-256

[randombit]

openssl-sys seems to support a lot of features wrt version autodetection, etc here so may be a good one to study.

[randombit]

Becomes possible with #109/#137

[randombit]

#178

[randombit]

New behavior is tarball downloads and is checksumed against fixed value, with env-based override for special cases. Seems good enough.