http() with a checksum revalidates against the origin every session, and fails when the origin errors #15032

What happens. http(url, checksum: ...) revalidates against the origin in every session. In core/http.go, HTTPState.Resolve always sends a GET with If-None-Match or If-Modified-Since, even when the state's snapshot already holds content whose digest equals the checksum. If the origin answers with anything other than 200 or 304, the call fails with invalid response status ..., though the engine already has the exact bytes the checksum names.

Reproduction. Fetch a file with http(url, checksum: <its sha256>) in one session. In a new session against the same engine, make the origin return 500 and fetch the same file with the same checksum. The second call fails with invalid response status 500 Internal Server Error.

Where we hit it. A CI check downloads a GitHub release asset with its checksum to build an image. On a warm engine, a GitHub 500 during the revalidation failed the image build and two checks that depend on it. The asset hadn't changed and was already in the engine's cache.

Proposed fix. When a checksum is given and the snapshot's content digest matches it, return the snapshot without a request. A PR follows.