creates_sources_inc: Replace SHA-1 with SHA-256
SHA-1 is basically broken since 2020 [1] and there's no reason to assume that sha256sum isn't available, so just use SHA-256 checksums. We use it for the versions file already, just not for the source info page of the release announcement yet.