Add support for validityUrl

Packager currently only provides a null validityUrl response for all signed exchanges. It would be nice to support validity updates, to save on network bandwidth when responding to intermediaries and to allow client-side reverification of signed exchanges as a [downgrade mitigation](https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#seccons-downgrades).

Note that this will require a refetch of the document to get the message to sign, unless a cache is added. If a cache is added, it should obey the usual HTTP caching semantics re: freshness and validation.

Start by tracing how the packager currently returns a null validityUrl for signed exchanges and how it obtains the document to sign. Review the signed-exchange response path and determine whether an HTTP cache exists or must be added with normal freshness and validation semantics. Done means validity updates are returned, refetching or caching is handled, and client reverification and downgrade mitigation work as intended.

Written by the indexing model from the issue text.