COMP: Mirror CastXML binaries with multi-URL fallback (SWIG/PCRE already done)

SWIG and PCRE archives already resolve through a multi-URL mirror helper
(landed in #6484), but CastXML was never converted: each platform still has a
single GitHub release URL, so any GitHub asset hiccup fails configure outright.
This is the residual cause of recurring `ARMBUILD-Python` download flakes.

Current state — Wrapping/Generators/CastXML/CMakeLists.txt

`_castxml_version` is pinned at `2026.01.30` (git tag `9864b1ee75ff…`). Every
platform sets exactly one URL, all on `github.com`:

| Line | Asset |
|---|---|
| 49 | `castxml-alma-linux-8-x86_64.tar.gz` |
| 67 | `castxml-alma-linux-8-arm-aarch64.tar.gz` |
| 87 | `castxml-windows-win11-amd64.zip` |
| 114 | `castxml-macos-15-intel-x86_64.tar.gz` |
| 132 | `castxml-macos-15-arm64.tar.gz` |

all prefixed `https://github.com/CastXML/CastXMLSuperbuild/releases/download/v${_castxml_version}/`
and consumed at line 152:

```cmake
ExternalProject_Add(
castxml
URL
${_castxml_url}
URL_HASH SHA256=${_castxml_hash}
```

The from-source fallback path is equally single-sourced: lines 260, 279, and 309
fetch `cmake-`, `llvm-`, and `clang-*.src.tar.xz` from
`github.com/llvm/llvm-project/releases/download/llvmorg-…`, and line 347 clones
`https://github.com/CastXML/CastXML.git`.

There is no occurrence of `itk_swig_mirror_urls` or `data.kitware` anywhere in
this file.

The pattern to reuse — already in-tree for SWIG/PCRE

`Wrapping/Generators/SwigInterface/CMakeLists.txt` defines
`itk_swig_mirror_urls()`, which emits an ordered URL list:

1. `data.kitware.com` by sha512 hashsum (primary),
2. ITKTestingData over GitHub Pages,
3. IPFS gateways (`dweb.link`, `ipfs.io`, `gateway.pinata.cloud`).

It is applied to the SWIG binary archive, the SWIG source archive, and PCRE.
Landed via #6484 ("COMP: Move ITK Python wrapping to SWIG 4.4.1"); release-5.4
got the equivalent via #6547.

Proposal

1. Upload the pinned CastXML binaries (all five platform assets for
`v2026.01.30`) to `data.kitware.com`; publish CIDs.
2. Generalize `itk_swig_mirror_urls()` into a shared helper (it is not
SWIG-specific) and call it from the CastXML `ExternalProject_Add`, so CMake
receives an ordered URL list still validated by the existing
`URL_HASH SHA256=` pin.
3. Apply the same treatment to the LLVM/Clang source tarballs on the
build-from-source path.

Impact: `ARMBUILD-Python` required multiple reruns on PRs #6089 and #6090 for
download failures alone.

Related but distinct from #6566, which proposes caching CastXML *output* to cut
wrapping time rather than mirroring its *download*.

Start with Wrapping/Generators/CastXML/CMakeLists.txt and compare its download setup with the helper in Wrapping/Generators/SwigInterface/CMakeLists.txt. Trace the binary, LLVM/Clang source, and CastXML fetch paths, then verify the affected configure/build path. Done means the pinned assets have ordered mirror fallbacks while existing hashes remain enforced, with the shared helper usable outside SWIG.

Written by the indexing model from the issue text.