tarsum is not actually used by the registry. Remove support for it.

Convert numerous uses in unit tests to SHA256.

Update docs to remove mentions of tarsums (which were often inaccurate).

Remove tarsum dependency.
Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>