feat(developer): source files from remote URLs

[mcdurdin]

TEMP: this is very much not ready for production; opening as a draft for public comment.

I will split the 'file.description' removal into a separate PR later.

The concept here is that the 'Name' property for a file can now be a remote reference, rather than a local file. There are two supported formats in this commit:

• GitHub: This is a cutdown version of a plain github.com URL, and must match this exact format:

  github:<owner>/<repo>/raw/<hash>/<filepath/filename>
  

  This format is mandated in order to ensure that we always have a hashed version of a file from the origin. This gives us reproducible builds, which avoids churn issues when font files change.

  Example: github:silnrsi/fonts/raw/b88c7af5d16681bd137156929ff8baec82526560/fonts/sil/alkalami/Alkalami-Regular.ttf gets https://github.com/silnrsi/fonts/raw/b88c7af5d16681bd137156929ff8baec82526560/fonts/sil/alkalami/Alkalami-Regular.ttf

  An alternative could be to just have https://github.com/silnrsi/fonts/raw/b88c7af5d16681bd137156929ff8baec82526560/fonts/sil/alkalami/Alkalami-Regular.ttf which could be matched with a regex in the same way as the github prefix, and would avoid the need to munge the input URL. Discuss!

• fonts.languagetechnology.org: references just a font identifier. This is somewhat broken, because if the source file changes, we don't know about it and won't publish an updated version of the package. So this needs some more discussion (we could e.g. embed the version number in the request, e.g. flo:[email protected]). Discuss!

  flo:<family>
  

  e.g. flo:andika gets https://fonts.languagetechnology.org/fonts/sil/andika/Andika-Bold.ttf

Future sources could be considered, e.g. noto. We don't want to allow arbitrary URLs, both for stability and for security reasons.

This change is entirely compiler-side, so we don't need to make any changes to apps, and so packages will be backwardly compatible. A lot of work will need to be done with the Package Editor in TIKE to support this feature.

Fixes: #11236