Bump purl to v0.1.20 (#4)

packageurl-go v0.1.7 now decodes %2F in subpath fragments to a
segment separator, so docs%2Fexamples is a valid two-segment
subpath. Drop the test case that asserted the old rejection.

Add verified artifact acquisition (#1)

* Add verified artifact acquisition

* Enforce size limits on cached artifacts

* Reject artifact download size mismatches

Fix artifact validation and digest support

Add artifact value module