feat: support URL input for /v1/validate

[pasibun]

Summary

• add support for url query parameter on /v1/validate when request body is empty
• fetch and validate remote content over http/https with a 10s timeout
• keep existing body-based behavior unchanged
• document URL usage in README
• add endpoint tests for URL success and failure cases

Why

This allows clients to validate a hosted publiccode.yml directly without first downloading and piping file contents into --data-binary.

Testing

• go test ./...

[pasibun]

#32