Add Gradle witness (or something similar)

We could use the gradle witness plugin as in briar or maybe use the checksum-dependency plugin which has already been discussed here: briar!1175 (closed)