Build/Test Tools: Retry and verify the Gutenberg download on the 7.0 branch.

[62873] merged [62859] and [62862] to this branch, but carried only the workflow
half: it touched a single file, .github/workflows/phpunit-tests.yml. The
downloader rewrite from [62859] never landed here.

So tools/gutenberg/download.js still streams the archive from the GitHub
Container Registry as fetch body, gunzip, then tar stdin in one pipeline, with
no temporary file, no size or SHA-256 check, no timeout, and no retries. An
early stream close raises Node's ERR_STREAM_PREMATURE_CLOSE and the build fails
with "Download/extraction failed: Premature close" before a test runs.
tools/gutenberg/utils.js has the same gap in its token and manifest requests.

The PHPUnit workflow on this branch is insulated, because [62873] wired it to
consume the shared prepare-gutenberg run artifact and it never calls the
downloader. Anything else that checks out this branch and runs `npm run
build:dev` still hits the raw downloader, once per job.

Merge the downloader half of [62859]: stage the blob to a temporary file, verify
the manifest size and SHA-256, extract only after verification, and retry
interrupted transfers up to three times. Metadata requests get the same bounded
retries and a timeout. This also makes the branch honour GUTENBERG_EXPECTED_SHA,
which reusable-phpunit-tests-v3.yml already passes it.

tools/gutenberg/copy.js also differs between the branches, but that drift is
from unrelated work and is left alone.

Fixes #66028.

Author: lancewillett