Apache release policy

[Sidney Markowitz]

I opened https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7596 and want to 
make sure it is noticed in time for our next release. We are required to use 
SHA-256 or SHA-512 checksums for our distribution downloads, and to not use 
SHA-1. I don't see any reason to use SHA-512 instead of or in addition to SHA-256.

 Sidney