GHA stats artifact downloader does not skip mismatched workflow run attempts

### 🐛 Describe the bug

`tools.stats.upload_stats_lib._download_artifact()` is intended to skip GitHub-hosted fallback artifacts whose embedded `runattemptN` token does not match the requested `workflow_run_attempt`.

Today the mismatch branch only prints a `Skipping ...` message. After that, the function continues to download the artifact, writes it to disk, and returns the path to `download_gha_artifacts()`.

This can let a previous workflow attempt's GitHub fallback stats artifact be mirrored into the current attempt's S3 prefix by `tools.stats.upload_artifacts`.

### Reproduction

A minimal mock reproduction shows the mismatch branch still calls `requests.get()`:

```python
from pathlib import Path
from unittest.mock import mock_open, patch

import tools.stats.upload_stats_lib as u

calls = []

class Response:
content = b"zip-bytes"

def fake_get(url, headers=None):
calls.append(url)
return Response()

with patch.object(u, "_get_request_headers", return_value={}), \
patch.object(u.requests, "get", side_effect=fake_get), \
patch("builtins.open", mock_open()):
u._download_artifact(
Path("test-reports-runattempt1-test-job.zip"),
"https://example.com/artifact",
workflow_run_attempt=2,
)

assert calls == []
```

Current behavior prints the skip message but still records one request call.

### Expected behavior

When an artifact name contains a `runattemptN` token that does not match the requested `workflow_run_attempt`, `_download_artifact()` should skip the download and `download_gha_artifacts()` should not return that artifact path.

### Impact

The realistic trigger path is the GitHub Actions artifact fallback mirror:

```text
upload-test-stats.yml / upload-torch-dynamo-perf-stats.yml
-> python -m tools.stats.upload_artifacts
-> get_artifacts(... workflow_run_attempt ...)
-> download_gha_artifacts(...)
-> _download_artifact(...)
```

On workflow reruns, a previous attempt's GitHub fallback artifact can be downloaded, have its `-runattemptN` token stripped, and then be uploaded into the current attempt's S3 namespace. This affects stats artifact handling; it does not imply the primary S3 upload path is broken.

cc @malfet @pytorch/pytorch-dev-infra

Start in tools.stats.upload_stats_lib._download_artifact() and trace how download_gha_artifacts() handles its return value. Run the mock reproduction from the issue, then verify that a mismatched runattemptN artifact makes no requests, is not written, and does not produce a returned artifact path.

Written by the indexing model from the issue text.