Resolve a DRS URI into a workspace, against hosts named in advance

[jorgeMFS]

Closes F2 (#21). Based on datasource-interface (#69), the D1 it depends
on, and nothing else — it adds a third provider behind that seam, which is what
that file’s own docstring says F1 and F2 should be.

The design follows from one fact

drs://host/id resolves to https://host/ga4gh/drs/v1/objects/id. The URI
names its own host, and the URI comes from the client. Following one unchecked
makes this service a request generator pointed wherever a workflow says — from
inside a TRE, at whatever that TRE can reach and the caller cannot.

So BIOCHEF_DRS_HOSTS is an allowlist with no default, and unset disables
the source. Same shape as BIOCHEF_LOCAL_ROOT, whose comment says it confines
itself because the client chooses the path. Here the client chooses the host.

Compact identifiers are refused. Resolving drs://prefix:accession means
asking a third-party resolver which host to contact — taking an endpoint out of
a document and then trusting it completely, which is a mistake this service has
already made twice.

I read the specification before writing this time, which is why the endpoints,
the access_id exchange and the checksum handling are the spec’s rather than my
guess at them.

What the audit then found

Redirects walked around the allowlist. urllib follows 3xx by default, so
an allowlisted DRS server answering 302 sent this service wherever it liked. The
allowlist checked the URI it was handed while the request ended up somewhere
else, which makes the control decorative. The DRS API now refuses redirects
outright; the bytes still follow them, because an access_url is expected to
bounce to storage and the allowlist never covered that host — but only while it
stays on https.

A download failing its checksum was left under the workflow’s own name,
holding whatever the server sent. That is the C1 gap reopened by a different
protocol. Bytes are staged, verified, then renamed.

A test that was worth nothing until the mutation said so

The staging test asserted "nothing is left behind" — and passed with the
staging removed, because both designs clean up after a failure. The difference
only exists while the bytes are in flight.

It now watches the workspace on every chunk and asserts the workflow’s own file
never appears before the checksum has been checked. That version fails against
the unstaged one.

Other decisions

• An object id becomes a path segment, so one containing a slash or a leading
  dot is refused before anything is opened — with a test asserting nothing is
  opened at all for a host outside the allowlist, since an allowlist applied
  after the request documents a policy already violated.
• Checked against the sha-256 or md5 the object declares; one declaring
  neither is refused rather than taken on trust.
• A server sending far more than its declared size is cut off, because the
  workspace writer has no reason to know what was claimed.

241 passed, 4 skipped. Nothing in the tests touches the network — the
transport is injected, so these are about what this service decides.

Note

I pushed one commit here with a pre-existing test red: the file that enumerates
the providers names them exactly, deliberately, and I added a third without
updating it. Fixed in the commit after, but it should not have gone out.