Package.resolved changes and binary artifact downloads are now more reliable

The dependency lockfile is no longer rewritten when its contents haven’t changed, so repeated tuist install runs should stop producing spurious diffs. Binary artifact downloads (such as GitHub release asset xcframeworks) also now use the correct HTTP headers, fixing cases where they could fail or produce checksum mismatches under certain cache states.