Fetch retrieves the POP list from url with an overall deadline of timeout.
Returns the POPs on success. Returns an error (and nil POPs) on any failure:
timeout, non-2xx status, invalid JSON, or unrecognised schema. Callers should
fall back to their baked-in list on error.