Support pinning remote imports by hash

[andreabedini]

Cabal 3.8 allows us to use import: https://www.stackage.org/lts-19.10/cabal.config inside cabal.project.

Someone might be interested in pinning down that file with a cryptographic hash, for security or reproducibility reasons. Perhaps this is a feature worth considering.

[Mikolaj]

For context, this is where the new functionality is being added to cabal 3.8: #7783.