test artifact caching

[jku]

from @segiddins: we should test artifact caching.

This is a bit tricky since I'm not sure we can assume that the TARGET_DIR we define for the test suite is the actual application cache -- this means we likely can't do the real test of "if we maliciously modify the cached artifact, will client re-download?"

That said, we could at least check that client does cache artifacts:

• modify CLIENT-CLI.md so it mentions that download_target() must use an artifact cache
• make sure the embedded clients actually use cache
• in the tests, do two download_target() calls in a row and expect the client to only download once