COMP: Mirror CastXML binaries with multi-URL fallback (SWIG/PCRE already done)

[hjmjohnson]

SWIG and PCRE archives already resolve through a multi-URL mirror helper
(landed in #6484), but CastXML was never converted: each platform still has a
single GitHub release URL, so any GitHub asset hiccup fails configure outright.
This is the residual cause of recurring ARMBUILD-Python download flakes.

Current state — Wrapping/Generators/CastXML/CMakeLists.txt

_castxml_version is pinned at 2026.01.30 (git tag 9864b1ee75ff…). Every
platform sets exactly one URL, all on github.com:

Line	Asset
49	castxml-alma-linux-8-x86_64.tar.gz
67	castxml-alma-linux-8-arm-aarch64.tar.gz
87	castxml-windows-win11-amd64.zip
114	castxml-macos-15-intel-x86_64.tar.gz
132	castxml-macos-15-arm64.tar.gz

all prefixed https://github.com/CastXML/CastXMLSuperbuild/releases/download/v${_castxml_version}/
and consumed at line 152:

    ExternalProject_Add(
      castxml
      URL
        ${_castxml_url}
      URL_HASH SHA256=${_castxml_hash}

The from-source fallback path is equally single-sourced: lines 260, 279, and 309
fetch cmake-, llvm-, and clang-*.src.tar.xz from
github.com/llvm/llvm-project/releases/download/llvmorg-…, and line 347 clones
https://github.com/CastXML/CastXML.git.

There is no occurrence of itk_swig_mirror_urls or data.kitware anywhere in
this file.

The pattern to reuse — already in-tree for SWIG/PCRE

Wrapping/Generators/SwigInterface/CMakeLists.txt defines
itk_swig_mirror_urls(), which emits an ordered URL list:

1. data.kitware.com by sha512 hashsum (primary),
2. ITKTestingData over GitHub Pages,
3. IPFS gateways (dweb.link, ipfs.io, gateway.pinata.cloud).

It is applied to the SWIG binary archive, the SWIG source archive, and PCRE.
Landed via #6484 ("COMP: Move ITK Python wrapping to SWIG 4.4.1"); release-5.4
got the equivalent via #6547.

Proposal

1. Upload the pinned CastXML binaries (all five platform assets for
   v2026.01.30) to data.kitware.com; publish CIDs.
2. Generalize itk_swig_mirror_urls() into a shared helper (it is not
   SWIG-specific) and call it from the CastXML ExternalProject_Add, so CMake
   receives an ordered URL list still validated by the existing
   URL_HASH SHA256= pin.
3. Apply the same treatment to the LLVM/Clang source tarballs on the
   build-from-source path.

Impact: ARMBUILD-Python required multiple reruns on PRs #6089 and #6090 for
download failures alone.

Related but distinct from #6566, which proposes caching CastXML output to cut
wrapping time rather than mirroring its download.