[New Feature]: Support Icon Files in Winget Community Repository

### Description of the new feature/enhancement

**Description:**

Currently, icon files for winget packages are hosted in a Microsoft internal repository, accessible only through the winget client. This setup limits the ability of users, developers, and third-party tools to retrieve and use package icons without relying on the client.

**Motivation:**

Making icons accessible in the public winget community repository would enhance transparency, improve integration with third-party tools, and simplify the review and validation process for package visuals. This would align with the open-source spirit of the winget ecosystem.

**Proposed Solution:**

Add support for including icon file metadata directly in the open winget-pkgs community repository by:

1. Hosting the icon files publicly (e.g., via GitHub CDN or as external, public URL).
2. Including a SHA256 hash of the icon to ensure file integrity and security.

This ensures icons are publicly accessible and verifiable without depending on the winget client or internal infrastructure.

**Benefits:**

- Enables public access to package icons.
- Improves UX for users and third-party tools.
- Maintains security through hash verification.
- Promotes transparency and consistency across packages.

### Proposed technical implementation details (optional)

To implement this, we propose extending the defaultLocale YAML manifest file to include two additional fields:

```
PackageLocale: en-US
Publisher: Contoso
PackageName: ContosoApp
IconUrl: https://github.com/microsoft/winget-pkgs/path/to/icon.png
IconHash:
```

- IconUrl: Direct URL pointing to the hosted image (ideally hosted on GitHub as part of the package).
- IconHash: SHA256 hash of the icon file for validation by clients.

This implementation keeps the metadata structured and secure, and aligns with existing manifest validation practices in winget.

Start by reviewing the defaultLocale YAML manifest structure and the repository's existing manifest validation practices. Determine how publicly hosted icons and SHA256 metadata would fit those manifests and validation rules. Done means the repository can represent publicly accessible, verifiable package icons without relying on internal infrastructure.

Written by the indexing model from the issue text.