pdp: accept urls array and provider host/cids in pull piece requests

[snadrus]

Fixes #1252

Summary

POST /pdp/piece/pull still accepts the current pieces: [{pieceCid, sourceUrl}] form. Additional sources are top-level so there is no nested plural under pieces[]:

{
  "pieces": [
    { "pieceCid": "<CommP-v2-CID>", "sourceUrl": "https://example.com/piece/bafy..." }
  ],
  "urls": ["https://backup.example.com/piece/bafy..."],
  "provider": {
    "host": "sp.example.com",
    "cids": ["<optional-retrieval-CID>"]
  }
}

All three fields are optional. Curio assembles them into the same per-URL pull item list used today.

• urls entries must end in /piece/{cid}; the CID is taken from the path.
• Provider URLs are assembled as https://{host}/piece/{cid}.
• If provider.cids is omitted, piece CIDs already collected from pieces and urls are used.
• provider.cids without provider.host is rejected.

Test plan

• AssembledSources() covers legacy pieces, top-level urls, provider host/cids, host fallback to known CIDs, JSON form, and de-dupe
• provider.cids without provider.host returns an error
• Handler tests for mixed sources and provider-only requests
• Existing pull validation and handler tests still pass (go test ./pdp -tags skiff for the non-DB pull cases)
• DB-backed backpressure tests were not run here (no local Yugabyte)