security: expand CAS blob verification

[cyphar]

Currently we verify that layer hashes match (against the DiffID), but it's probably a good idea that we also verify that the CAS blobs all are correct. We can probably do this by wrapping the returned blob with a verifier that returns an error on EOF if the digest is mismatched (though we'd have to make sure our Close calls as well as any io.Copy errors are all correctly checked).

[cyphar]

This slightly depends on a change within #280.