This required a fair bit of surgery because previously ostree.h included otutil.h, but that's supposed to be a private library.
Don't expose GChecksum in APIs. Add a new stream class which allows us to pass an input stream somewhere, but gather a checksum as it's read. Move some bits of the internals towards binary csums.