Add http & https asset sources (clean commit history)

[mrchantey]

Objective

This is a duplicate of #16366 because I made a mess of the commit history. See that pr for more context and discussion.

• Fixes Feature: Upstream bevy_web_asset, allowing assets loaded via http #16307
• Closes Add http & https asset sources #16366

Licencing

this pr adds two licences:

• ureq > webpki-roots: MPL-2.0
• aws-lc-rs > aws-lc-sys: OpenSSL

ci still picks up ring because examples/remote/client.rs is still using default-features. Perhaps in another pr we can expose a general fetch function with the aws-lc-rs machinery used in this pr.

Solution

• Add http & https asset sources

Testing

• Verify visually by running cargo run --example http_source

---

Showcase

Bevy now supports assets loaded via url!

Add the http_source feature to load assets served over the web, with support for both native and wasm targets. On native targets the http_source_cache feature will use a basic caching mechanism to avoid repeated network requests.

  // Simply use a url where you would normally use an `assets` path
  let handle = asset_server.load("https://raw.githubusercontent.com/bevyengine/bevy/refs/heads/main/assets/branding/bevy_bird_dark.png");
  commands.spawn(Sprite::from_image(handle));

Further Work

• Better AssetReaderError: The asset path is not always collected in the error. This is likely a common error that actual non-developer users will see so its important to get it right.
• Allow users to select a crypto provider: By default we're using aws-lc-rs because it has a cleaner license than ring but apparently it requires cmake installed on windows so may be less ergonomic.