include list of official mirrors in index.xml

When a given repo is blocked, slow, or on an expensive connection, it should be easy to find and use mirrors of that repo. Following the Debian model, if we use the signing key as the trusted ID of a given repo, then any repo can be freely mirrored anywhere and it will still be trusted. The metadata should have a field for listing "official" mirrors so that the client can easily find and try mirrors.

I'm assigning this to me for now so as not to place the burden on others, but anyone should feel free to implement this. :-)