Automatic release of main @ d06eafd

reduce potential lock contention; avoid goroutine leak

Hitting the wrench process with `kill -SIGQUIT <pid>` showed in the goroutine
stack trace dump that one goroutine was hung on an HTTP request doomed to
never finish. Unfortunately, that also meant it held the mutex used to prevent
concurrent writes forever - which meant the cache was unable to add new Zig
versions - leading to bug reports like https://github.com/mlugg/setup-zig/issues/5#issuecomment-2181355145
indicating fetching a new Zig version was impossible.

This fixes it by reducing the lock contention, and using an HTTP client with
an actual timeout (Go's defaults suck here, crazy that the default function
for 'make an GET request' can hang forever and leak a goroutine, or worse as
in this case.)

```
goroutine 25991611 [select, 1612 minutes]:
runtime.gopark(0xc00040e9f0?, 0x4?, 0xa8?, 0x83?, 0xc00040e948?)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/runtime/proc.go:398 +0xce fp=0xc00040e7e0 sp=0xc00040e7c0 pc=0x43be2e
runtime.selectgo(0xc00040e9f0, 0xc00040e940, 0x3?, 0x0, 0x4159fa?, 0x1)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/runtime/select.go:327 +0x725 fp=0xc00040e900 sp=0xc00040e7e0 pc=0x44b8e5
net/http.(*http2ClientConn).RoundTrip(0xc000446000, 0xc000662300)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/h2_bundle.go:8381 +0x44f fp=0xc00040ea40 sp=0xc00040e900 pc=0x6cf4cf
net/http.(*http2Transport).RoundTripOpt(0xc000128360, 0xc000662300, {0x70?})
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/h2_bundle.go:7649 +0x1b1 fp=0xc00040eb70 sp=0xc00040ea40 pc=0x6cb431
net/http.(*http2Transport).RoundTrip(0x16b3000?, 0xc0001479c0?)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/h2_bundle.go:7598 +0x15 fp=0xc00040eb98 sp=0xc00040eb70 pc=0x6cafb5
net/http.(*Transport).roundTrip(0x16b3000, 0xc000662300)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/transport.go:602 +0x78b fp=0xc00040edc0 sp=0xc00040eb98 pc=0x6fd3eb
net/http.(*Transport).RoundTrip(0x0?, 0xf98720?)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/roundtrip.go:17 +0x13 fp=0xc00040ede0 sp=0xc00040edc0 pc=0x6e6253
net/http.send(0xc000662300, {0xf98720, 0x16b3000}, {0x1?, 0xffffffffffffffff?, 0x0?})
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/client.go:260 +0x606 fp=0xc00040f010 sp=0xc00040ede0 pc=0x6a4166
net/http.(*Client).send(0x16d3380, 0xc000662300, {0xc00040f0c0?, 0x5f6bc5?, 0x0?})
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/client.go:181 +0x98 fp=0xc00040f088 sp=0xc00040f010 pc=0x6a39f8
net/http.(*Client).do(0x16d3380, 0xc000662300)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/client.go:724 +0x912 fp=0xc00040f298 sp=0xc00040f088 pc=0x6a5d32
net/http.(*Client).Do(...)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/client.go:590
net/http.(*Client).Get(0xf97a60?, {0xc00032f450?, 0xe5a75c?})
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/client.go:488 +0x5f fp=0xc00040f2f0 sp=0xc00040f298 pc=0x6a52bf
net/http.Get(...)
        /opt/homebrew/Cellar/go/1.21.6/libexec/src/net/http/client.go:457
github.com/hexops/wrench/internal/wrench.(*Bot).httpPkgEnsureZigDownloadCached(0xc0000979a0, {0xc0005d4f5a, 0x19}, {0xe50bab, 0x4}, {0xc0005d4f49, 0x2a})
        /Volumes/data/hexops/wrench/internal/wrench/http_pkg.go:417 +0x8a7 fp=0xc00040f7a0 sp=0xc00040f2f0 pc=0xc42467
```

Signed-off-by: Stephen Gutekanst <[email protected]>