Verify gem checksums against committed file

Only verified if env var is set. If verification fails, bundle install
refuses to proceed.

Add docs for developers on how to update Gemfile.checksum