Verify pinned Voikko dictionary downloads

[Blackspirits]

Summary

The Finnish Voikko spell-check entry downloads two pinned assets from SubtitleEdit/support-files and immediately writes/unpacks them. This current-base port preserves the already-reviewed exact-URL SHA-256 verification and fail-closed policy.

This change:

• binds the two current Voikko assets to their exact official release URLs and SHA-256 digests
• verifies the downloaded stream before the caller can write the DLL or unpack the dictionary ZIP
• fails closed for unknown assets on the current Voikko release
• fails closed for future SubtitleEdit/support-files Voikko releases until their exact URLs/hashes are registered
• rejects the pinned Voikko release path when served from another origin
• rewinds verified/rejected streams for the existing install flow
• leaves generic Hunspell/LibreOffice dictionary URLs and behavior unchanged
• carries the reviewed regressions for both official digests, future/unknown releases, wrong-origin rejection, tampered payload rejection, valid rewind and unchanged generic downloads

Current-base verification

• SpellCheckDictionaryDownloadService.cs is byte-for-byte identical between the old reviewed base and current upstream 5e9ae4ff332010302cc5b584ef90226518d8dc5f (blob 2fc8aba0652805299540ae6200c96996edaf054e)
• the reviewed production blob 4e41605a3acd4b81e8212cb5138e74b13eff4250 and test blob 9a17758fdd50ed23910cbe64b9f7745297e6bca7 were transplanted exactly onto the current upstream tree
• current diff is one commit / two files
• libvoikko-1.dll SHA-256: bfffd537ff372b425a61940d4f5ac6c80e2a745dab33cc00ac50e8f50441d1b0
• dict.zip SHA-256: 98f26bb67e08288910fbf1aa92521f28bee79538ba86aefa267713333e7fa537
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• retry step was not used
• validation run: #34753155081

Base is current upstream 5e9ae4ff332010302cc5b584ef90226518d8dc5f.

This PR supersedes internal draft #52.

AI assistance: ChatGPT was used to verify exact base-file identity and transplant the already-reviewed Voikko integrity fix onto current upstream without modifying unrelated code.