Support downloads and attested fields on OAS registry

[DropSnorz]

Support recently introduced fields on OAS Package/File:

attested	boolean	Optional. Computed once at import time - true if this file has a GitHub Artifact Attestation linking it to the CI run/commit that built it (checked via the GitHub attestations API using this file's own url/sha256). Omitted rather than storing false when not attested - most developers won't have this configured yet.

downloads	number	Optional. Total download count for this exact file, sourced from the GitHub Releases API. Recomputed on every registry build (unlike attested, this changes continuously); omitted when zero or not yet fetched.

Reference: open-audio-stack/open-audio-stack-registry#594