feat: law-source-bund 0.1.0 (source.bundesrecht)

Fetch one German federal law from gesetze-im-internet.de (BMJ) by its
site slug, unpack the BMJ norm XML from the site's xml.zip and return
it content-addressed (SHA-256) plus the BMJ builddate, so a flow's
audit trail pins the exact Gesetzesstand it processed.

- xml.zip unpack picks the largest XML entry (norm body)
- lying ZIP size header rejected instead of silently truncated
  (audit integrity); 64 MB unpack cap, 96 MB download cap
- net permission pinned to www.gesetze-im-internet.de; no auth
- 11 unit tests (no network), wasm32-wasip2 build green

Signed-off-by: flemming-it <sf@flemming.it>

NOTICE

@@ -0,0 +1,25 @@
+law-source-bund
+Copyright 2026 Flemming.AI
+
+This product includes software developed by Dr. Stefan Flemming
+and contributors (https://flemming.ai/).
+
+------------------------------------------------------------------
+Third-party acknowledgments
+
+ZIP unpacking uses the `zip` crate
+(https://github.com/zip-rs/zip2), MIT licensed.
+
+SHA-256 hashing uses the `sha2` crate
+(https://github.com/RustCrypto/hashes), Apache-2.0 / MIT licensed.
+
+Module SDK glue is provided by `chain-module-sdk`
+(https://git.flemming.ai/fai/chain-module-sdk-rust), Apache-2.0.
+
+------------------------------------------------------------------
+Data source
+
+Fetches public legal texts from gesetze-im-internet.de, the joint
+publication site of the Federal Ministry of Justice (BMJ) and
+juris GmbH. The texts themselves are official works exempt from
+copyright protection under § 5 UrhG.