website: add Downloads page per ASF release policy (#771)

* website: add Downloads page per ASF release policy

Adds a /downloads route covering the 0.42.0-incubating and 0.41.0-incubating
releases with mirror-selection links for tarballs, direct HTTPS links for
signatures and checksums, GPG/SHA-512 verification instructions, and the
standard incubator disclaimer. Adds a "Download" entry to the navbar.

Addresses the IPMC vote feedback that burr.apache.org needs a public
download page per https://www.apache.org/legal/release-policy.html#publication.

The repo-root .gitignore has a `downloads/` rule (Python packaging), which
shadows the new Next.js app-router directory; a negation rule is added in
website/.gitignore to re-include it.

* website: restructure downloads page for end users

Lead with install + UI launch + quick links, then ASF source
releases, then verification. Apache compliance content is still
present but no longer the first thing a Python dev sees.

Also: flag 0.41.0 PyPI packaging issues with a note on its release
card, and render version headings as "X.Y.Z (incubating)" rather
than "X.Y.Z-incubating".

Author: elijahbenizzy

website/.gitignore

@@ -4,3 +4,7 @@ out/
 *.tsbuildinfo
 next-env.d.ts
 public/docs/
+
+# The repo-root .gitignore has `downloads/` (Python packaging convention),
+# which would otherwise hide the Next.js /downloads app route. Re-include it.
+!src/app/downloads/