During the 3.3 release some packages were missing in SVN during the release and it ended up building the release tarball without issues when re-running the `make source_archive_complete` command after it failed initially. The tarball however had 0 byte files for the missing packages.... not good. This diff hardens the download process by : 1) Validating all required variables are set. This catches the erroneously attempt at downloading the nanovdb package even though we have removed it from versions.cmake but neglected to remove it from download.cmake 2) When a download fails (due to either a missing package, or bad download URL) FILE Download will warn about a hash mismatch but will carry on happily, you then have to go into the file system go delete the 0 byte file to retry the download. We know for a fact the file is bad when it is 0 bytes, just delete it. 3) When we are using the blender repository (and likely building a source archive) explicitly validate the hash of all packages. Normally the build process does this, however when building a source archive the build does not actually run for a dep. So preform this check during the configuration stage. Reviewed By: brecht Differential Revision: https://developer.blender.org/D16124