Add switch to enable rctx.download() remote caching even if sha256 is not specified

### Description of the feature request:

The resolution of https://github.com/bazelbuild/bazel/issues/23932 was to disable remote caching (e.g. when using `experimental_remote_downloader`) of `rctx.download()` resources if no sha256 is specified, since that usually is an indicator that the resource is intentionally ephemeral.

However in some cases the sha256 is omitted, but integrity still happens later some other way in the repo rule. For example if fetching packages from a `go.mod` file, we won't have sha256s but we can still check integrity manually via the `go.sum` file.

In these cases, we *do* want the resource to be remotely cacheable even though a sha256 is not specified.

Can we add an option to `download`/`download_and_extract` to opt-in to remote caching, such as `force_allow_caching = True`? Essentially if set it would skip over the logic introduced in https://github.com/bazelbuild/bazel/pull/23995.

### Which category does this issue belong to?

External Dependency, Remote Execution

### What underlying problem are you trying to solve with this feature?

To enable remote caching (e.g. using `experimental_remote_downloader`) of manually verified `rctx.download()` resources that omit a sha256 parameter.

### Which operating system are you running Bazel on?

macos

### What is the output of `bazel info release`?

release 8.3.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start with the rctx.download() and rctx.download_and_extract() entry points and review the caching behavior introduced by pull request 23995. Define how an opt-in switch should allow remote caching when sha256 is omitted while preserving the current default, then verify the behavior against the remote downloader use case described here.

Written by the indexing model from the issue text.