Allow suppression of 404 code from repository_ctx.download

Many rulesets and user configurations include several mirrors for an artifact. A common one is that mirror.bazel.build is used as a secondary url.

However it's hard to predict ahead of time which mirrors host what. For example in rules_nodejs we gave up on using mirror.bazel.build because it was too hard to mirror every single release artifact given the manual process of requesting that from the bazel team.

Another example is in rules_jvm_external where the list of urls is constructed from the list of maven mirrors and the list of packages, without regard for which packages are hosted where. In https://github.com/bazelbuild/rules_jvm_external/issues/349#issuecomment-582499282 @jin suggests that this should be fixed in `repository_ctx#download*` functions.

I imagine this would take the form of a new keywoard-argument to that function. Perhaps this is specific to 404, or maybe we allow users to indicate what HTTP response codes they want to ignore.

Start with the repository_ctx#download* functions and the mirror use cases described for rules_nodejs and rules_jvm_external. Determine whether the API should suppress 404 responses specifically or accept a configurable set of HTTP status codes; done means the behavior and keyword argument are clearly defined and supported by the affected download functions.

Written by the indexing model from the issue text.