pull code: support contenturl setting

pull code: support contenturl setting

Allow users to pass a --contenturl during `remote add` and store it in
the remote config.

Fish out the contenturl setting from the remote config and use it when
downloading static deltas and objects (except for commit signatures).
The idea here is that items in the trust chain (summary & sigs) can be
fetched from a more secure e.g. TLS-pinned location, while objects
themselves are fetched from another location. Once mirrorlist support is
added, this use-case will become even more advantageous.

Closes: #469
Approved by: cgwalters