Document edge cases and limitations of cabal's package-hashes

[andreabedini]

The package hashes that cabal computes are good but not perfect. I need to document in which case they can fail and what to do in those cases.

References:

• @newhoggy has already documented some caveats
• RFC: Make nix-store packages relocatable haskell/cabal#4097.
• Also related RFC: Remote cache support haskell/cabal#5582