build: verify checksum of Go download in CI (#21911)

.circleci/config.yml

@@ -150,10 +150,14 @@ commands:
     steps:
       - run:
           name: Upgrade Go
+          # GO_VERSION_HASH is from https://golang.org/dl/
           command: |
             mkdir -p ${HOME}/.tools
-            wget https://golang.org/dl/go1.16.5.linux-amd64.tar.gz
-            tar -C ${HOME}/.tools -xzf go1.16.5.linux-amd64.tar.gz
+            GO_VERSION=1.16.5
+            GO_VERSION_HASH=b12c23023b68de22f74c0524f10b753e7b08b1504cb7e417eccebdd3fae49061
+            wget https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz
+            echo "${GO_VERSION_HASH}  go${GO_VERSION}.linux-amd64.tar.gz" | sha256sum --check --
+            tar -C ${HOME}/.tools -xzf go${GO_VERSION}.linux-amd64.tar.gz
             echo 'export PATH=${HOME}/.tools/go/bin:${PATH}' >> $BASH_ENV
 
   # Install dependencies for cross building binaries with goreleaser. Does not include Docker cross-builder.