Pin and verify checksums for kubectl versions downloaded at runtime (#2350)