[simonchrz]

Fixes #466.

Go module zips are stored under the module's PURL, which lowercases golang names, and under {last element}@{version}.zip. github.com/Sirupsen/logrus and github.com/sirupsen/logrus therefore shared one cache entry although upstream serves different zips, and whichever was requested second failed go's checksum check.

• A module path with capitals now gets a hash of its exact spelling in the filename, logrus@v1.0.6~{hash}.zip. All-lowercase paths keep the plain name, so existing cache entries stay valid.
• A capitalised module cached before this change sits under its lowercase twin's plain filename. When a cached zip's upstream URL names a different module path, it is discarded and fetched again. Only the module path is compared, so a cache filled from another upstream.go host is kept (Changing upstream invalidates the cache #486), and a record whose URL isn't a Go module URL is left alone.
• The PURL itself stays lowercase, so both spellings are still one package for retention rules, the UI and the cache API.

Testing

Handler tests fetch both spellings twice and check each gets its own bytes and is fetched once, that a legacy entry for the other spelling is refetched, and that an entry from another upstream host is served from cache. The golang retention test now finds the capitalised module under its new filename.