fix: harden HTTP request security against downgrade and timing attacks

[John-David Dalton (jdalton)]

Summary

• HTTPS-to-HTTP redirect downgrade protection: Both httpDownloadAttempt and httpRequestAttempt now reject redirect responses that attempt to downgrade from HTTPS to HTTP
• Constant-time hash comparison: SHA256 checksum verification in httpDownload now uses crypto.timingSafeEqual instead of string !== to prevent timing side-channel attacks
• Randomized temp file paths: Download temp files now use crypto.randomBytes(6) hex suffix instead of a predictable .download extension, preventing symlink/race attacks
• Constant-time integrity comparison in dlx/binary: SRI integrity verification now uses crypto.timingSafeEqual instead of string !==

Test plan

• test/unit/http-request.test.mts — 100 tests pass
• test/unit/dlx/binary.test.mts — 47 tests pass, 3 skipped (pre-existing)
• Lint and type-check pass