Mirror support

[dasimmet]

Hi @marler8997,

closes: #44

Here's my take on community mirror support.

• download is not done using the fetchCmd anymore, instead download the archive and sigfile temporarily using fetchFile, validate and then pass the archive path to fetchCmd to get the hash. I had to make it not panic anymore and return errors instead.
• i had to upgrade the zig sources to 0.14.1 to support passing a file path instead of an url to fetchCmd.
• added another dependency, the zig implementation of minisign
• the existing mirrorlist will be reused whenever it cannot be fetched anymore