Fix CATH downloads: use https, and check the response before caching it - #1136

The download-validation helpers added in 7.0.0 (biojava#979, biojava#980) had several gaps
that only surface once a caller passes a real hash URL or downloads from a
server that can 404. All of them are fixed here, and hash verification is
implemented rather than stubbed.

Correctness fixes:

* createValidationFiles(URL, ...) passed a literal Hash.UNKNOWN to its
  URLConnection overload instead of the caller's argument, so it could never
  write a hash file and threw IllegalArgumentException for any caller that
  supplied a hashURL.
* Neither downloadFile nor createValidationFiles checked the HTTP status, so a
  404 error page was written into the cache as though it were the requested
  file. Because the .size sidecar was then taken from that same error response,
  validateFile subsequently declared it valid. A new HttpStatusException lets
  callers tell "the resource is not there" apart from a transport failure,
  which matters for anything that tries several mirrors in turn.
* downloadFile used FileChannel.transferFrom(rbc, 0, Long.MAX_VALUE), which is
  not guaranteed to drain a socket-backed channel and could silently truncate a
  download. Replaced with Files.copy, which loops to end of stream.
* downloadFile leaked its temporary file on every failure path.
* validateFile threw NullPointerException for a file with no parent directory,
  and again if listFiles() returned null; an empty .size file raised an
  unchecked NoSuchElementException that escaped the surrounding catch.
* validateFile checked only the first hash sidecar it found, ignoring the rest.

New functionality:

* validateFile now really verifies MD5, SHA-1 and SHA-256 instead of throwing
  UnsupportedOperationException. Sidecars are written as bare lowercase hex and
  parsed tolerantly, so a file downloaded verbatim from a server in coreutils
  or BSD layout is also understood. A sidecar that cannot be parsed is skipped
  with a warning rather than failing an otherwise good download.
* ETagPolicy lets an ETag that is a bare hex digest be recorded as a checksum
  without a second request. files.wwpdb.org and files.rcsb.org return the
  content MD5 as the ETag, so every download from the wwPDB archive now gets a
  real integrity check for free. The <mtime>-<size> ETags used by the EBI
  servers contain a dash and can never be misread as a digest; a test pins that.
* downloadFileWithValidation downloads and validates over a single connection.
  The previous pattern opened one connection to read Content-Length and another
  to fetch the bytes, so the recorded size described a different response than
  the one written; if the resource changed in between, the cache entry was left
  permanently failing validation. Content is digested while streaming to a temp
  file and only moved into place once length and checksum check out.

LocalPDBDirectory uses the new single-connection download, and its two-character
directory hash is promoted to the reusable getMiddleHash(String). That hash
deliberately counts from the end of the identifier so that both spellings of an
entry land in the same bucket: 1cbs and pdb_00001cbs both give "cb", where
counting from the start would file the extended form under "db".

Defaults change slightly: the existing four-argument createValidationFiles
overloads now use ETagPolicy.USE_IF_HEX_DIGEST, so callers start recording
checksums where the server offers one. Targeted at 7.3.0.