refactor(audit): batch 5 — share the updater HTTP/download layer

XmrigUpdater and DaemonUpdater carried byte-identical libcurl code —
httpGet, downloadToFile, and the write/progress callbacks — including the
security-critical TLS-verify (SSL_VERIFYPEER=1 / SSL_VERIFYHOST=2) and
max-body-size options, duplicated across two signature-verified
download-and-execute files that had to be hand-kept in sync.

Hoist that machinery into src/util/http_download.{h,cpp}:
- util::httpGetString(url, logTag)
- util::httpDownloadToFile(url, dest, logTag, maxBytes, onProgress)
threading progress + cancellation through a std::function (returning false
aborts the transfer) instead of the class `this` pointer. Each updater's
httpGet/downloadToFile become one-line forwarders that bind their own log
tag and archive-size cap (64 MiB miner / 256 MiB node, both preserved).

Every curl option is preserved byte-identically (verified by diffing the
setopt lines against the pre-change code — the only deltas are the
now-parameterized MAXFILESIZE cap and the XFERINFODATA payload). No behavior
change; the TLS/size-guard options now live in exactly one place.

Deliberately scoped DOWN per the audit's own guidance: the divergent
per-updater logic (release DTOs/parsers, checksum-table parsing, version
compare, and installResolved's per-member-SHA vs transitive-trust verify,
install strategy, and chmod scope) stays in each class — NOT merged behind a
base-class/virtual-hook layer, which would raise review cost on
signature-verified execute-code and risk a subtle security regression. The
shared-DTO/parser consolidation (~77 test refs of churn on stable code) is
left as a separate, lower-value follow-up.

Full-node + Lite build clean; ctest 1/1; source-hygiene clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CMakeLists.txt

@@ -505,6 +505,7 @@ set(APP_SOURCES
     src/util/lite_server_probe.cpp
     src/util/pool_registry_core.cpp
     src/util/pool_stats_service.cpp
+    src/util/http_download.cpp
     src/util/xmrig_updater.cpp
     src/util/xmrig_updater_core.cpp
     src/util/daemon_updater.cpp
@@ -1049,6 +1050,7 @@ if(BUILD_TESTING)
         src/util/logger.cpp
         src/util/lite_server_probe.cpp
         src/util/pool_registry_core.cpp
+        src/util/http_download.cpp
         src/util/xmrig_updater.cpp
         src/util/xmrig_updater_core.cpp
         src/util/daemon_updater.cpp