Use canonical_id in rctx.download and use the latest github release version

[Strum355]

From the docs: default is ''. If set, restrict cache hits to those cases where the file was added to the cache with the same canonical id

With http_archive, the default is the value of the url(s) provided, for the following reason: This helps catch the common mistake of updating the URLs without also updating the hash, resulting in builds that succeed locally but fail on machines without the file in the cache.

The lack of this default for rctx.download resulted in the exact issue described by http_archive to us recently. As such, this PR updates uses of rctx.download to mimic that behaviour to avoid this footgun.

Also addresses a ~2yr old TODO around using https://api.github.com/repos/bufbuild/buf/releases/latest once v1 is hit

[CLAassistant]

All committers have signed the CLA.

[perezd]

Thank you!