comrade: update to 0.1.16, add a comrade-tests package and test.sh

comrade: update to 0.1.16, add a comrade-tests package and test.sh

Upstream history:
https://github.com/dangowrt/comrade/compare/v0.1.1...v0.1.16

Also adds comrade-tests, a separate package carrying comrade's compiled
test suite (its unit tests, comrade-e2e, and its end-to-end scenario
scripts) so none of it reaches an end-user comrade install. CI's own
test.sh wires up the unit tests through comrade-tests' own
run-unit-tests.sh; both discover what to run from what was actually
installed rather than a hardcoded list, so neither goes stale as
upstream's own suite grows. stream_cc_test and natstream_test are
skipped there instead of run: the first asserts a throughput floor
QEMU user-mode emulation can't reliably clear, the second does real
ICE/NAT gathering, so run-unit-tests.sh skips both by default;
COMRADE_SKIP= run-unit-tests.sh runs them too, e.g. on real hardware,
and comrade-tests' own description now says so. The variable is
namespaced rather than a plain SKIP, matching COMRADE_E2E_NET below,
so it can't collide with whatever else a CI harness's environment
happens to define. run-unit-tests.sh also warns if a listed test ever
matches no installed binary, so a rename or removal upstream surfaces
as a message instead of silent drift. Each test runs under busybox
timeout with a 600 second bound, 5x upstream's largest CTest TIMEOUT
of 120 seconds with margin left for the slowest emulated targets, so
a test that wedges under QEMU fails in minutes and by name rather
than holding the job to its six-hour limit. The end-to-end scenarios
need real network or multicast conditions, and some a live DHT, that
CI's QEMU emulation cannot promise, so they ship for manual use on
real hardware instead.

PKG_SOURCE_URL now points at the release's own tarball instead of
GitHub's codeload archive: codeload's compression is not guaranteed
byte-stable release to release, which broke a hash pinned against
v0.1.12 within hours of that release going out, while a release asset
is frozen the moment the tag's release is published. The tarball is
still produced with `git archive`, so it still carries no submodule
content and deps/always-online-stun still arrives empty for
Build/Prepare to fill.

The STUN list pin matches this release's own deps/always-online-stun
commit. comrade tries every server in the pool in rotation now, not
just the first entry, but a pool with many dead entries still degrades
public-IPv4 discovery, so this still wants refreshing on every bump.

Signed-off-by: Daniel Golle <redacted>