Verify pinned Voikko dictionary downloads

[Blackspirits]

Superseded by internal PR #78, which ports the reviewed Voikko exact-URL SHA-256 verification and fail-closed policy onto current upstream base 5e9ae4ff332010302cc5b584ef90226518d8dc5f using the exact reviewed production/test blobs, and passes restore/build/full-suite CI on the first run (#34753155081). This draft is retained only as historical evidence and must not be merged.

[Blackspirits]

Independent adversarial re-check on current upstream base: confirmed the installer only writes/unpacks Voikko bytes after DownloadDictionary completes; the two exact official support-files URLs are bound to their published SHA-256 values; unknown/future Voikko support-files release paths fail closed; wrong-origin reuse of the Voikko release path is rejected; generic dictionary URLs remain outside the Voikko-specific check. Full current-base CI run #34704369743 passed on the first test run with no retry. No blocker identified. Keep draft; no merge/promotion performed.

[Blackspirits]

Independent adversarial re-check on current upstream base: reconfirmed the two exact Voikko support-files URLs and their published SHA-256 digests; current and future/unregistered Voikko release paths fail closed, wrong-origin lookalikes are rejected, generic dictionary downloads remain outside the Voikko policy, and the caller only writes/unpacks after verification succeeds. Full current-base CI run #34704369743 passed on the first test run with no retry. No blocker identified. Keep draft; no merge/promotion performed.