[Security] Model Metadata and Download Fallback via Plaintext HTTP — MITM Supply Chain Risk

download.cpp uses plaintext HTTP for critical operations:

• Line 161: release.json metadata fetched from http://gpt4all.io/meta/release.json
• Line 173: latestnews.md from http://gpt4all.io/meta/latestnews.md
• Line 214: Model download fallback from http://gpt4all.io/models/gguf/

Hash verification exists (line 560) but the expected hash comes from the same HTTP metadata endpoint (release.json). MITM attacker substitutes both the hash and the model file — verification passes with malicious content.

Fix: change http:// to https:// on lines 161, 173, 214. Also enforce TLS cert verification.