Add support for Brioche.download() for locked downloads

[kylewlacy]

Companion PR: brioche-dev/brioche-packages#75

Part of #70

This PR updates the project analysis in Brioche to find instances of Brioche.download("..."), then to download the referenced URL and record the hash in the lockfile (without requiring the user to specify the hash directly). This only works when the argument is a literal string, and it will fail at analysis time and at runtime otherwise. This is in line with the other "statics" that are implemented today (Brioche.glob, Brioche.includeFile Brioche.includeDirectory).

As with the other statics, the runtime implementation of Brioche.download is not in the brioche repo, but will instead be part of the std package.

Here's a usage example:

// The hash will be recorded in `brioche.lock`
const source = Brioche.download(
  "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-1.7.1.tar.gz",
)
  .unarchive("tar", "gzip")
  .peel();