Manually changing the list every time we want to change the libsodium
version is painful.
I tested this glob against libsodium 1.0.17 and verified it produces the
same set of files (aside from the generated version.h), and that in
1.0.18 it produces the same set modulo upstream files removed/added.
Fix hash verification in downloaded libsodium package.
Fix @VERSION@ expansion in sodium/version.h (but don't set it globally
because VERSION is far too generic a variable to be leaving set).
