feat: validate hashes from direct urls and enable hashstrategy from uv

[zelosleone]

this is definitely a draft for now. it still needs some more work and more testing

[zelosleone]

Also now that we are getting the hashes from url with correct parsing and segments, we dont need this PR anymore #3696 that's also why i removed the code of url normalization of that pr

[baszalmstra]

Nice work!

I think we should immediately make this configurable. We also have a "fast" verification path for rattler which we could also enable/disable.

For direct urls it looks like this will download the packages twice? Once to verify and once to install. Even if the package is cached?

[zelosleone]

Nice work!

I think we should immediately make this configurable. We also have a "fast" verification path for rattler which we could also enable/disable.

For direct urls it looks like this will download the packages twice? Once to verify and once to install. Even if the package is cached?

That's one of the problems with current uv's verification actually, say we have it in cache, and we put the wrong hash, it still allows the wrong hash to pass as if its the correct hash. (even though it installs from the cache) I don't think that's good in general but i am open to your suggestion definitely, i simply thought this could be misused or/and misguide users as if some kind of magic is done behind the scenes, so instead it doesn't trust UV and verifies the package by not depending on the cache.