Securities feature

[ickc]

Split off from #2:

1. trust 3rd party package manager (e.g. pip, cabal), because we cannot do anything about this.

2. For simple package that pandocpm install directly, either

   1. point to a particular commit (security by SHA-1 and by our sanitization in pull request of formula)

   2. point to a centralized repo (see An optional centralized repository for simple packages #8) that I might create later, under pandoc-extras. In this case it can point to the latest commit. (security by our sanitization in pull request to that repository)

Edit: It almost goes without saying: https should be required in any urls.

[ickc]

@sergiocorreia, I guess this is considered to be finalized? I'll close it for now and if you have objection you can reopen it.