audit --download should check appcast as well

[vitorgalvao]

This is a typical version bump PR:

Which means something (now) important and (currently) unchecked might be lurking under.

Having to do this for every PR will likely makes us miss some.

Solution: make Travis check for it. Better solution: make audit do the work, since it seems appropriate. Also, we’ll get audit_modified_casks for free.

It makes sense to only check for it on audit --download, since otherwise the cask might be correct. It should do three checks:

• Does appcast return a 200 HTTP response code?
• Is checkpoint: different than e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty string)?
• Is checkpoint: correct?

[adidalal]

https://github.com/caskroom/homebrew-cask/blob/master/lib/hbc/audit.rb

(2) is already checked for.

(1) and (3) could be done by extending check_download, as technically the same thing is already done for url