change __contains__ in manifests to do an ident/md5 combination check

[ctb]

right now it only checks for md5sum, which will cause weird problems in not-so-edge cases.

ref #2747, #2762, #2617, #2593.

The reason I didn't just implement this quickly is that the sqlite implementation to get ident might be tricky and I need to look into how to do it correctly and efficiently.