lib: use sha1 instead of md5 in a couple of places md5 is dead and should be avoided. In the places changed here, we want to keep using hashes without trivial collisions, but do not expect strong crypto security. sha1 seems like a trivial step up from md5 and without obvious alternatives. It is more expensive than md5, but we can live with that in these places. The remaining few uses of md5() cannot be changed without breaking backwards compatibility or external API.