ci: Retry and fail fast when the Ragel download is unavailable

[flavio-fernandes]

Problem

The shell lane in PR #961 failed for a reason unrelated to the pull request:
the CI dependency bootstrap could not download Ragel 6.10 from
www.colm.net.

Failed job:
https://github.com/purpleidea/mgmt/actions/runs/29648627858/job/88091031551

Relevant log:

https://www.colm.net/files/ragel/ragel-6.10.tar.gz
HTTP request sent, awaiting response... 503 backend read error
tar: Child returned status 1
cd: /tmp/ragel/ragel-6.10/: No such file or directory
...
bash: line 1: ragel: command not found
make[1]: *** [Makefile:56: interpolate/parse.generated.go] Error 127

The dependency step continued after the failed download/extract/build, so the
workflow surfaced the less useful ragel: command not found failure later
during generation.

Suggested fix

Harden the Ragel bootstrap in misc/make-deps.sh:

1. Retry the download a small, bounded number of times.
2. Retry transient HTTP responses such as 429, 500, 502, 503, and 504, with a
   short delay/backoff and explicit connect/read timeouts.
3. Download to a temporary filename and validate the gzip/tar archive before
   extracting it.
4. Fail the dependency step immediately if download, extraction, build, or
   installation fails.
5. Keep the Ragel version and source pinned; do not silently fetch a moving
   release.

For GNU Wget, the download could use the equivalent of
--tries=5 --waitretry=5 --retry-connrefused --retry-on-http-error=429,500,502,503,504
plus bounded timeout options. Exact flags should remain compatible with the
oldest supported CI environment.

Acceptance criteria

• A transient HTTP 503 followed by a successful response completes dependency
  installation.
• Permanent download failure stops make deps at the Ragel step with the
  source URL and a clear error.
• A truncated or invalid archive is rejected before extraction.
• CI does not continue into language generation without a usable ragel
  executable.

[purpleidea]

Good idea, thanks! Converting to discussion as per #871