Remove the embedded sha1 code, and use one of botan or gcrypt

This adds a hard dependency on one of Botan or gcrypt. Botan is already a
recommended dependency, and gcrypt is probably packaged almost everywhere,
so this should not be a big deal.

ref #3241