fetch: check a cache directory for files matching expected SHAs

[imjasonh]

This adds a --cache-dir flag (default "/var/cache/melange"), which is bound into the build environment at /var/cache/melange (constant), and updates the fetch.yaml pipeline to look for files matching the expected-sha{256,512} in that directory.

The intention is that builds could pre-fetch external dependencies into
the cache directory, then execute builds without hitting the network.

If --cache-dir doesn't exist, it's not bound and fetch will always wget.

Also adds CI checks to build all examples.

Fixes #144

[imjasonh]

This passes tests, but it doesn't actually work. /var/cache/melange is never actually populated inside the build environment, so we never get a cache hit. I'm not sure what I'm missing, I'll take another look in the morning.

[imjasonh]

This should work now. I can try to add an e2e test that populates and exercises the cache, but it may be tough to prove it doesn't hit the network in GitHub Actions.

[kaniini]

This should work now. I can try to add an e2e test that populates and exercises the cache, but it may be tough to prove it doesn't hit the network in GitHub Actions.

We can ask bubblewrap to unshare the network namespace.

[imjasonh]

This should work now. I can try to add an e2e test that populates and exercises the cache, but it may be tough to prove it doesn't hit the network in GitHub Actions.

We can ask bubblewrap to unshare the network namespace.

Ooh! A new flag for melange that passes --unshare-net to bwrap?