Add sha256 support for bzlmod case

[adrianimboden]

I started to use rules_rust, which uses rules_buf.
I also use bzlmod and download all dependencies ahead of time to support builds without internet access.

For this to work, all downloads from the internet need to provide sha256 hash in the download actions. I saw that for the WORKSPACE style usage, this already works (buf_download_releases already supports that).

This MR adds the correct hash for v1.28.1 and allows to also override the hash in addition to the version.

[CLAassistant]

All committers have signed the CLA.

[calebzulawski]

I just ran into this and would like this supported as well. We use --repository_disable_download in some situations and I am unable to use rules_lint which depends on rules_buf.