apt proxies: with an upstream that has no by-hash, InRelease and Packages from two generations are served together, and apt-get update fails with "Hash Sum mismatch" #798

Problem

• An apt proxy caches every non-by-hash file under dists/<distribution>/ as a raw file of its own (crates/formats/apt/src/proxy.rs:52-55).
• Each file is re-validated on its own checked_at clock (fresh_file and is_due, crates/server/src/files/proxy.rs:288-310, :436-440), and a 304 resets only that file's clock.
• Clients that already hold the lists re-validate only InRelease, because apt skips an unchanged Packages. So the cached InRelease and Packages drift apart.
• Nothing ties a cached Packages to the InRelease that is served with it.

Scenario

This applies to an upstream whose Release has no Acquire-By-Hash: reprepro's default, aptly's default, packagecloud, many vendor repositories.

1. A fresh container fetches Packages.gz at 12:05, while InRelease is still the copy cached at 12:00.
2. The upstream publishes at 12:20.
3. A fresh container at 12:21 gets a re-validated new InRelease and the cached old Packages.gz. Or the other way round: an old InRelease and a new Packages.gz.
4. apt-get update exits 100 ("Hash Sum mismatch" / "File has unexpected size") for up to metadata_ttl_seconds after each upstream publish. Release and Release.gpg can mismatch the same way.

Debian and Ubuntu archives are not affected, because apt fetches their indexes by hash.

Expected

• An index file that the served InRelease/Release lists is re-validated whenever its cached size or SHA-256 differs from that listing.
• When InRelease or Release is replaced, the distribution's other non-by-hash files become due.

E2e test with the mock mirror: cache both files, change the upstream, re-validate only InRelease, and check that the Packages served then matches it.

New with #176 (#725). #760 and #762 cover pool and by-hash files. Found in the 2.2.0 release review.