feat: support URL input for /v1/validate

[pasibun]

Summary

• add support for url query parameter on /v1/validate when request body is empty
• fetch and validate remote content over http/https with a 10s timeout
• keep existing body-based behavior unchanged
• document URL usage in README
• add endpoint tests for URL success and failure cases

Why

This allows clients to validate a hosted publiccode.yml directly without first downloading and piping file contents into --data-binary.

Testing

• go test ./...

[pasibun]

#32

[bfabio]

Thanks, nice work!

Before merging I think we should detail a few security risks that come with outbound HTTP fetches from a public endpoint that were mentioned in #32.

I'd list them in that issue so we can track mitigations, WDYT?