Use Hugging Face Hub for CI model downloads

[rmorse]

Summary

• Pre-downloads test models with Hugging Face Hub before running cargo xtask test-setup.
• Uses the repository HF_TOKEN secret for authenticated model downloads when available.
• Caches the downloaded model files to reduce repeated Hugging Face resolver traffic.
• Documents the HF_TOKEN CI secret in CONTRIBUTING.md.

Notes

The vendored whisper.cpp download scripts are left untouched. Once the models are pre-downloaded into whisper-cpp-plus-sys/whisper.cpp/models, cargo xtask test-setup should skip the upstream download scripts.

Verification

• git diff --check passed locally.
• CI should verify the authenticated download path on macOS.