Incorporate SE-0292 feedback into RegistryDraft (Third Review)

[mattt]

This PR includes the following changes to the draft registry specification in response to feedback for SE-0292.

• Change "A client SHOULD verify the integrity of a downloaded source archive" to "A client MUST verify the integrity of a downloaded source archive”
• Remove clause about registry servers that index but don't host source archives
• Replace existing uses of "SHALL" to "MUST", which is an equivalent, stylistic variant
• Remove unnecessary Etag headers from example responses
• Update OpenAPI specification to add 3XX response
• Update OpenAPI specification to add operationId (useful for code generation tools)

[mattt]

@swift-ci Please smoke test

[tomerd]

@mattt @robertlacroix @yim-lee and myself discussed this more, and I think @robertlacroix preference is for this to be part of the metadata as he originally proposed. any strong reason why we should not move it there?

another good observation @robertlacroix made after discussing the redirecting proxies is that all APIs should support 30x return code to signal the redirect. any reason why we should not make this explicit in the spec?

[tomerd]

@mattt is this read to be merged? also should this be renamed given the proposal acceptance?

[mattt]

@tomerd Yes, this is ready to be merged. Good call on renaming. I just pushed that with 8185efe.

[mattt]

@swift-ci Please smoke test