add .narinfo/.nar substitution returning io/fs

[flokli]

• retrieving the .narinfo and .nar file from a (http) binary cache
• unpacking the .nar file, validating the signatures and providing a io/FS to the contents
• if no signature/size check is requested, immediately return the io/FS before downloading all of it.

This could probably even be composed. By using io/fs for the source too, we could plug in something reading .narinfo and .nar` files from a (private) AWS/GCP bucket.

[zimbatm]

There is also the .ls file that could be used to provide the file hierarchy without downloading the NAR. If the NAR itself is uncompressed you could do Range requests.

[flokli]

Yes, this could be another option, that's available only when we don't validate signatures.