Hermetic Oracle GDS downloads

[sgammon]

At the moment, the bindist map of artifacts → hashes can't cover Oracle GraalVM components, because these are served from Oracle's Global Download Service (GDS) which doesn't have predictable artifact URLs.

These are our options:

• Talk to their API. We could re-use some of GraalVM's code for this, but the integration would be brittle and probably break when gu is deprecated, which is coming up.

• Register all hashes manually. This is a pretty lame outcome, so let's avoid it.

• Move components to predictable URLs on our own infra. This is banned by license and still requires maintainer intervention.

• Provide a user-facing repository input for artifacts of this nature. We could take an approach similar to how rules_kotlin handles custom kotlinc distributions. This is probably what we should do.

[sgammon]

Got some advice from the GraalVM team on this topic: