The two functions (`generateFileHash()` and `validateFileHash()`) are
tightly-coupled.  Most changes to one would require a matching change in the
other.  So they should be parallel.

It'd be OK to say "the hash formula is a general utility for any party using
file APIs" (so put `generateFileHash()` and `validateFileHash()` in `CRM_Core_BAO_File`).

It'd be OK to say "the hash formula is specific to the end-point/page which
serves files" (so put `generateFileHash()` and `validateFileHash()` in
`CRM_Core_Page_File`).

The former feels a bit more accurate, so I pushed it toward that.