chore: improve max download restrictions for malicious metadata tutorial

[art1f1c3R]

Summary

Changes the behaviour and way max_download_size is accessed with respect to package source code analysis.

Description of changes

This PR makes two main changes. It moves the max_download_size configuration from slsa.verifier to downloads in defaults.ini, and adds a new function can_download_file that is used to check first if the source code of a package can be downloaded before acting upon this information. This is useful in DetectMaliciousMetadataCheck.analyze_source to ensure that a HeuristicAnalyzerValueError is not raised, and a subsequent UNKNOWN result is not returned if the file limit stops the source code from being downloaded.

This PR also updates the tutorial documentation to describe the changes needed to ensure some larger packages are downloaded when analyzing the source code.

Checklist

• I have reviewed the contribution guide.
• My PR title and commits follow the Conventional Commits convention.
• My commits include the "Signed-off-by" line.
• I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
• I have updated the relevant documentation, if applicable.
• I have tested my changes and verified they work as expected.