fix: verify gitlab package install script

[kiwigitops]

Summary

• replace the GitLab curl | bash bootstrap path with download, SHA-256 verification, then execution
• expose the expected script hash as a Terraform variable so deployments can intentionally update it
• remove the downloaded script after startup completes

Fixes #22.

Validation

• verified the default SHA-256 against the current GitLab package repository install script
• git diff --check

[aghassemlouei]

Thank you for the contribution @kiwigitops! I've requested a review from @LanceWray until I get more familiar with the codebase and we incorporate more automated tests.