Add explicit fallback sources for failed package downloads

[Copilot]

The build script was effectively single-source for several upstream packages. When a mirror or host timed out or served a truncated archive, the package build failed instead of trying a known alternate source.

• Summary

  • Allow package downloads to accept multiple URLs while preserving the existing retry and checksum checks.
  • Add explicit fallback sources for the GNU and pkg-config mirrors that commonly fail in practice.

• What changed

  • download() now accepts a list of sources and tries each URL in order before aborting.
  • GNU-based packages now declare primary + mirror URLs explicitly instead of hard-coding mirror logic into the helper layer.
  • pkg-config now declares a pkgconfig.freedesktop.org source and a GitHub release fallback.
  • Existing checksum validation and cached-file safety remain in place; fallback behavior only applies during a failed fresh download attempt.

• Example

DOWNLOAD_SOURCES=(
  "https://ftp.gnu.org/gnu/m4/m4-$CURRENT_PACKAGE_VERSION.tar.gz"
  "https://ftpmirror.gnu.org/gnu/m4/m4-$CURRENT_PACKAGE_VERSION.tar.gz"
)
download "${DOWNLOAD_SOURCES[@]}"

This keeps the failure mode predictable while making common mirror outages recoverable without changing the rest of the build flow.