Fix handling of downloaded files

Fix handling of downloaded files

We want the MinGW package builds to have the downloads provided in advance
as part of the source RPM, instead of requiring network access and fetching
them once for each of the win32 and win64 builds.

So let make find the file in its VPATH and then use the full pathname that
it puts into $< for the recipe. And use that recipe to validate the hash
of the file too.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>