unified cache file handling for vendorfile/subfile

lib.sh download() is used by subfile handling in git.sh,
e.g. crossgcc tarballs, and also the vendor scripts.

vendor files are cached, but not subfiles for repos.

cache both, under cache/file/, saved with the name equal
to the checksum, so: cache/file/CHECKSUM

also move vendorfiles/app/ to cache/app/ in this change.

Signed-off-by: Leah Rowe <leah@libreboot.org>

.gitignore

@@ -1,5 +1,6 @@
 *~
 *.o
+/cache/
 /lbmk.err.log
 /repo/
 /docs/