Description of problem:
Yum currently doesn't handle the situation when package is updated without changing its name (e.g. package was signed) with proxy enabled:

As discussed at https://www.redhat.com/archives/rhl-devel-list/2008-January/msg02361.html:
----------
Yum and "X-Cache: HIT"
======================
If you use wget --server-response and a target file, you see the raw
HTTP headers of that request.  If the file is already cached, you see a
HTTP header like below:

X-Cache: HIT from proxyserver.example.com

Proposal:
Improve yum with the following download logic:

IF (a downloaded repodata/* file doesn't match the repomd.xml checksum
    OR a downloaded RPM doesn't match the expected checksum)
   AND "X-Cache: HIT from" was in its HTTP header
THEN download it again with URLGrabber option: http_headers =
(('Pragma', 'no-cache')

This should solve the case where RPM files legitimately change contents
without changing filenames, like RPM signing.
-------

This feature is required for OSBS team to cache rpms used to build Docker containers, as the packages might be signed while being cached.



Steps to Reproduce:
1. Setup squid cache for a yum repo
2. Set 'yum_proxy' address for the repo on client machine
3. Make sure the package hits the cache - e.g. install the package on client machine using squid proxy
4. Sign the package with a new key
5. Install a package on different machine using squid as a proxy

Actual results:
Old package is fetched - yum will complain about mismatched checksum

Expected results:
Yum should be aware that proxy is used when checksums don't match and fetch the package avoiding proxy (using Pragma = no-cache header in request)