Add snapshot redirect and proxy endpoints

[linuskendall]

Summary

• add sidecar-compatible snapshot redirect endpoints for full and incremental snapshots
• add tracker redirect endpoints and concrete snapshot routes
• add proxy_snapshot_downloads config to proxy concrete snapshot downloads through the tracker
• rewrite /v1/snapshots and /v1/best_snapshots file URLs to tracker-local concrete URLs when proxying is enabled
• add optional proxy_snapshot_cache_dir support to cache the latest proxied concrete snapshot archive locally with atomic promotion after successful fetch

Cache behavior

• short-form endpoints always redirect and never proxy/cache directly
• concrete tracker snapshot URLs serve from cache when the cached archive matches the current best full or incremental snapshot
• stale cached snapshot archives are removed before refreshing the cache
• one request performs a cache refresh at a time; concurrent requests fall back to normal uncached proxy streaming
• HEAD requests serve cached size metadata when available or proxy upstream HEAD otherwise
• Range requests on a cache miss bypass cache population and proxy upstream directly

Refresh failure behavior

• refresh downloads stream to a temporary file and are promoted into the cache only after a successful 200 OK response
• if the client disconnects, the upstream fetch fails, or upstream returns a non-200 response, the temporary file is removed and no archive is promoted
• because stale archives are removed before refresh, a failed refresh for a new latest snapshot can leave the cache empty
• the next successful concrete GET for the latest snapshot repopulates the cache

Validation

• go test ./...
• go test ./internal/tracker
• go test -race ./internal/tracker
• live-tested tracker proxy downloads using test-http-target-config.yml semantics with proxy_snapshot_downloads enabled; confirmed short redirect and concrete paths start downloading snapshot bytes and HEAD returns Content-Length