feat(modelartifacts): bound Hugging Face file downloads

[localai-org-maint-bot]

Summary

• add opt-in bounded concurrency for independent artifact file downloads while keeping the default at 1
• cancel sibling transfers on the first download or verification failure and synchronize aggregate progress bookkeeping
• preserve deterministic manifest ordering, resumable partials, and SHA verification
• expose --artifact-download-concurrency / LOCALAI_ARTIFACT_DOWNLOAD_CONCURRENCY in server and models-install flows
• document conservative tuning guidance

Verification

• go test ./pkg/downloader -ginkgo.focus="DownloadFilesWithContext"
• go test ./pkg/modelartifacts
• go test -race ./pkg/downloader -ginkgo.focus="DownloadFilesWithContext"
• go test -race ./pkg/modelartifacts
• independent task review: PASS

Full pkg/downloader has three pre-existing tests that require blocked raw.githubusercontent.com access in this environment. core/cli compilation is also environment-blocked by unavailable Go proxy inputs and a missing generated React embed; the CLI changes are limited to Kong flag fields and manager-option wiring.

Closes #11114