download: get checksums file relative to git root

This means the update-hashes command can be run anywhere in Kubespray
repository without having to figure out the correct path.