system/nxpkg: Fetch the catalog and artifacts over the network.

[aviralgarg05]

Note: Please adhere to Contributing Guidelines.

Depends-On: /pull/3718

Summary

A package could only be installed from a catalog that was already on the
device, so getting one there meant copying it by hand.

This adds a synchronization path that reads an index from an http:// or
https:// source and stores it locally, along with the artifact download
that install needs. The catalog and the source it came from are written
under one lock, so the two cannot end up describing different syncs, and
the lock is renewed as data arrives so a slow download over a slow link is
not mistaken for an abandoned one and reclaimed while it is still running.

A repository is plain static files. Any host that can serve an index.json
and the artifacts it names works; no server-side logic is involved.

This is the third of four parts of #3642, which was one commit covering
several unrelated changes.

Impact

• New feature: YES, packages can be fetched over the network.
• User adaptation: NO. Existing local catalogs keep working.
• Build: YES, one new source file in system/nxpkg.
• Hardware: NO, but a target needs networking configured to use it.
• Documentation: The companion documentation is Documentation: Update nxpkg and add nxstore guide. nuttx#18875.
• Security: Payloads are verified against the SHA-256 in the manifest, so a
  corrupted or substituted artifact is rejected before it is installed.
  Plain HTTP carries no confidentiality; the digest covers integrity.
• Compatibility: A source that is not a URL is still treated as a path.

Testing

Build host: macOS 26.5, arm64, xtensa-esp-elf-gcc 14.2.0
(esp-14.2.0_20251107).

Target: Xtensa / ESP32-S3, Waveshare ESP32-S3-Touch-LCD-7.

• nxstyle, tools/checkpatch.sh, codespell and git diff --check on
  every changed file
• all system/nxpkg sources compiled for the target with this commit
  applied on top of system/nxpkg: Validate catalog and database contents before use. #3718

This commit does not build on master alone because it uses declarations
and helpers added by #3642 and #3718; the Depends-On line above lets CI
apply those first.

PR verification Self-Check

• This PR introduces one focused change.
• I have updated all required description fields above.
• I have reviewed and signed every commit.
• This PR adheres to the current contribution and coding guidelines.
• My PR is still work in progress.
• My PR is ready for review and can be safely merged.

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Validate catalog and database contents before use. #3718 @ c175040

CI run: https://github.com/apache/nuttx-apps/actions/runs/31526642262

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Validate catalog and database contents before use. #3718 @ c175040

CI run: https://github.com/apache/nuttx-apps/actions/runs/31812527831

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Validate catalog and database contents before use. #3718 @ 838ec14

CI run: https://github.com/apache/nuttx-apps/actions/runs/31878516657

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Validate catalog and database contents before use. #3718 @ 0525eb9

CI run: https://github.com/apache/nuttx-apps/actions/runs/31879828238

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Validate catalog and database contents before use. #3718 @ e309950

CI run: https://github.com/apache/nuttx-apps/actions/runs/31955916735