feat: add exact-version package denylist

[abhinavgautam01]

Partially addresses #358

Summary

Adds an explicit version-level denylist that works independently of cooldown and artifact scanning.

denylist:
  packages:
    - "pkg:pypi/requests@2.31.0"
    - "pkg:cargo/some-crate@1.2.3"
    - "pkg:npm/%40scope/example@4.5.6"

---

Changes

• Validate and canonicalize exact-version PURLs at startup.
• Filter denied versions from npm packuments, Cargo sparse indexes and PyPI simple HTML/JSON and release metadata.
• Apply filtering to cached metadata, including offline fallback, without requiring publication timestamps.
• Remove npm tags targeting denied versions and update latest to the highest remaining stable version when available.
• Reject denied artifact downloads with 403 before cache reads, signed redirects or upstream artifact fetches.
• Apply the download policy to mirror operations.
• Retain cached artifacts so removing a denial restores access.

Scope and limitations

• Metadata filtering covers npm, PyPI, and Cargo.
• Recognized Debian package downloads use the shared download guard, but signed APT metadata remains unchanged.
• Pass-through resources without a resolved package/version identity are not covered.
• Configuration changes require a restart.
• Existing signed URLs and client-side caches cannot be revoked.
• This is an operator-managed policy, not automatic CVE detection or cache re-scanning.

Validation

Added regression coverage for configuration validation, canonical PURLs, cached downloads, signed redirects, metadata filtering, offline fallback, cooldown interaction, malformed metadata and mirror denials.

Local checks passed:

• Formatting and git diff --check
• go tool golangci-lint run ./... — 0 issues
• go test -race ./...
• go vet ./...
• go build ./...
• go mod tidy -diff