Improve _HttpFile validator parsing

Parse ETag and Last-Modified headers rather than treating them as
opaque strings.
Factor ETag and last-modified time into cache path
Report I/O error to guest if package Last-Modified or ETag changes

so we don't present the guest a disk or memory image which is a
composite of multiple files.

For local packages, we only check the mtime and not the device, inode,
or file length, because libcurl does not provide those to vmnetfs.

Closes #16.
Fixes for servers that don't return a Last-Modified header
Add some missing status messages in compress_machine()