think through how to handle downloads

[BrianHicks]

We want to be able to download files. We probably need to do this fairly frequently, and should be able to do this without invoking some system tool like curl. At minimum, we probably need to be able to:

• download files from HTTP(S)
• verify that the downloaded files match some hash
• store the output in the content-addressable cache

The task here is not to actually implement this, but to create an ADR detailing what kind of API we want, exactly.