Add support for metalink

[nijel]

It might be useful to have support for metalink for downloads. The good thing on it is that it can include checksums and PGP signature for automated checking. The bad thing is that there doesn't seem to be client to implement PGP verification, so we're only back to checksums (and SHA-256 is mostly not supported as well).

See https://en.wikipedia.org/wiki/Metalink

This really needs decision whether it's worth of the effort.

[nijel]

Quoting Emanuel Bronshtein, who originally reported this:

About MetaLink, I don't know if it worth it, the idea behind it is great
[automatically checksum+signature verification]
soon I plan to ask the TAILS team which take the distribution issues
very seriously, they support officially only downloading via:

1. custom made browser extension that does checksum validation
2. Bitorrent (Torrent files) https://labs.riseup.net/code/issues/9043 as
   they have checksum validation.
   To ensure that checksums is always validated.

in case MetaLink is sufficient for tails use, then sure it's a lot of
added value and recommended to use, in case it's not because of some
issues then it depends.