support CAR meta in booster-http

### Checklist

- [X] This is **not** a new feature or an enhancement to the Filecoin protocol. If it is, please open an [FIP issue](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-0001.md).
- [X] This is **not** brainstorming ideas. If you have an idea you'd like to discuss, please open a new discussion on [the Boost forum](https://github.com/filecoin-project/boost/discussions/categories/ideas) and select the category as `Ideas`.
- [X] I **have** a specific, actionable, and well motivated feature request to propose.

### Boost component

- [ ] boost daemon - storage providers
- [ ] boost client
- [ ] boost UI
- [ ] boost data-transfer
- [ ] boost index-provider
- [X] Other

### What is the motivation behind this feature request? Is your feature request related to a problem? Please describe.

When I retrieve content from boost, I would like a response that I can use to tell someone else "this SP gave me the data I asked for.

currently that isn't true because there's no signature or attestation in the response - so there's no way to:
1. correlate the response as accurate for a given request
2. associate that the response has actually come from the specific SP

### Describe the solution you'd like

We propose to make use of https://github.com/ipfs/specs/pull/431 - the use of `metadata` within car responses that is an extension to IPIP-412 that allows for the use of a cbor key-value block to end a booster-http response.

in the final metadata block of a response from boost we propose to include 3 fields:
- `len` - byte length of the response data (excluding the metadata block)
- `b3h` - Blake3 hash (checksum) of the response data (excluding the metadata block).
- `b3h_sig` - A signature over `` using booster-http's libp2p identity.

### Describe alternatives you've considered

* this could be implemented as a trailer at the http transport level, but that limits compatibility with clients
* the response can remain un-attested, or only attested in specific cases, but that makes it too easy for an SP to not return correct data or to only return correct data to retrieval testing systems.

### Additional context

_No response_

Start by locating the booster-http response implementation and read the linked IPFS metadata proposal, including its extension to IPIP-412. The requested result is a final metadata block containing len, b3h, and b3h_sig, with the signature covering the response length, Blake3 hash, and request; no implementation files or tests are named.

Written by the indexing model from the issue text.