Merging the bearer-token cache (#92), streaming (#94) and HEAD (#89) PRs
independently left master not compiling: fetchBearerToken now returns
three values but headUpstream still assigned two, and cachedBearerToken
referenced sha256Hash which the streaming PR had removed. Restore the
sha256Hash helper (with its crypto/sha256 + encoding/hex imports) and fix
the headUpstream call site.