Source Digest

The digest of the exact source bytes the entries were projected from, in the same `sha256:` form the lock file uses, so the projection can be verified and reproduced.