fix(signatures): use origin URL basename for remote .sign downloads

[dragoangel]

• decouple remote signature filename from local DB alias
• derive remote sign name from origin URL path, preserving versioned naming
• keep local save path as .sign
• add regression coverage for local-name vs origin-name behavior
• harden test isolation with mocked HTTP and socket-level network guard
• remove sign files on cdiff retention
• remove sign files on database removal, including sign for cdiff versions

[dragoangel]

Hi @val-ms, could you please review this PR when you have a moment?

This fixes an important issue in signature handling for mirrored databases with custom local names. Before this change, the downloader could build the remote .sign filename from the local alias instead of the origin filename, which can cause signature downloads to fail or mismatch in real mirror setups.

This fix also covers proper cleanup for diffs retention and database delete logic.

P.s. also it would be good to release 1.3.0 before merging this PR and 1.3.1 - right after, as currently cvdupdate latest version is still 1.2.0, otherwise I need to include all my changes into 1.3.0.