spec: unify resource fetching type

[jlebon]

Dedupe the "remote resource" type from the spec. This came up too during
review of the new HTTP headers. They all had more or less the same
fields in common ("source", "verification", "compression", and more
recently "httpHeaders").

One noticeable spec level change from this is that some places now
support compression where they didn't before. Might seem odd to support
compression for e.g. certificate authorities, though it does make the
spec more consistent throughout.

It's a nice cleanup, though my goal with doing this is the ability to
inspect more easily whether a config contains any resources which
require some form of networking.

[jlebon]

Marking WIP for now. Haven't tested this much yet, nor run blackbox testing. There's also some subtle changes in validation since in some places source wasn't required and others it was. I think I caught those, but need to double-check.

One noticeable spec level change from this is that some places now
support compression where they didn't before. Might seem odd to support
compression for e.g. certificate authorities, though it does make the
spec more consistent throughout.

Still, if we prefer to keep the spec file unchanged for now, we can split this into Resource and CompressibleResource.

[bgilbert]

This LGTM generally; thanks for doing it! I don't see an obvious downside to making all resources compressible.

Tests to add:

• Compression tests for certificateAuthorities, replace, and merge
• Negative tests for certificateAuthorities, replace, and merge without a source specified

[bgilbert]

Okay, this should be ready for review. @jlebon, please take a look, and it'd be good to have a fresh reviewer also. @lucab?

[jlebon]

Awesome, thanks for picking this up and pushing it through, LGTM! (Looks like I can't actually approve it since it's my own PR.)

[lucab]

Code LGTM and the PR is stamped.
I do have a minor question on the public type change and semver, but I do think it's ok under the rules of "experimental".