Support ~/.netrc authentication for the HTTP provider

[jonnyyu]

Summary

Pass --netrc-optional to curl so that HTTP provider URLs behind basic authentication (for example, Artifactory) can be fetched using credentials from ~/.netrc.

• Hosts with a netrc entry are fetched with credentials. Other hosts are fetched anonymously. A missing netrc file is not an error.
• Credentials never appear in the DotSlash file, the curl command line, or error messages.
• Only the download (slow) path is affected. The cache-hit fast path does not read any file.
• On 401 or 403, the error now includes a hint to add a machine <host> login <user> password <token> entry to ~/.netrc (%USERPROFILE%\_netrc on Windows).
• Documented under "HTTP Provider" in dotslash-file.md.

Related: #38. This applies netrc globally with no opt-out. If a config file (#4) is preferred, this can be gated behind a setting later.

Test plan

• cargo test passes. The http__nonexistent_url snapshot is updated for the new curl argument.
• cargo clippy shows no new warnings compared to main.
• Manually verified on Windows: with a netrc entry for a private Artifactory host, dotslash -- create-url-entry fetches an endpoint that returns 404 without credentials.
• Manually verified the hint is shown when a URL returns 401.

🤖 Generated with Claude Code

[meta-codesync]

This pull request has been imported. If you are a Meta employee, you can view this in D125825578. (Because this pull request was imported automatically, there will not be any future comments.)