tagging @dotnet/roslyn-ide @jinujoseph

📝 This hash is not used for security-related purpose. Any hash code with a negligible risk of unintentional collision would be acceptable. For this purpose, SHA1 and SHA256 are equivalent. We are choosing to use the latter so this body of code stops appearing as a line item in internal security reviews.

The main concern in this space was performance. I completed an evaluation of SHA256 at scale (Roslyn.sln) with @heejaechang a few months ago and determined that, after we made a small fix that's already in place (#33496), the performance difference between the two would not be observable even by the most discerning users.

cc @tmat for review as well