Add Metalink 4 (RFC 5854) support

[ashledombos]

Implements a ?meta4 endpoint serving a Metalink 4.0 / RFC 5854 document for the requested file, as requested in #49.

What it does

A request carrying ?meta4 (or an Accept: application/metalink4+xml header) returns, instead of a 302 redirect, a Metalink document describing the file — its size, checksums, and the list of candidate mirrors ordered by preference:

<?xml version="1.0" encoding="UTF-8"?>
<metalink xmlns="urn:ietf:params:xml:ns:metalink">
  <generator>mirrorbits/...</generator>
  <published>2026-06-30T23:17:40Z</published>
  <file name="repomd.xml">
    <size>1539</size>
    <hash type="sha-256">8521c3...</hash>
    <url location="us" priority="1">http://mirror-us/.../repomd.xml</url>
    <url location="fr" priority="2">http://mirror-eu/.../repomd.xml</url>
  </file>
</metalink>

Served with Content-Type: application/metalink4+xml.

Why

Metalink-aware clients (aria2, wget2, ...) can then perform the final mirror selection, download from several mirrors and resume/verify the transfer themselves, instead of being tied to a single redirect — i.e. the traffic distribution, integrity check and resumable downloads asked for in #49.

Implementation notes

• Reuses the existing selection engine (geo ranking, scoring, mirror health). As with ?mirrorlist, the full candidate list is returned (no 5-mirror cap and no random reordering) so clients can fail over across all mirrors.
• Hash type names follow the IANA registry (sha-256, sha-1, md5); only the checksums actually computed for the file are emitted (honouring the Hashes config).
• <file name> is the basename; <url priority> is 1-based (1 = most preferred).
• Returns 404 when no mirror is available.

Tested

• go test ./http/... ./mirrors/... passes.
• End-to-end with aria2 (aria2c -M): it parses the document, downloads from a mirror and verifies the checksum successfully.

Not included (possible follow-up)

• Per-piece checksums (<pieces>) for segmented repair: mirrorbits does not currently compute block-level hashes.

Closes #49