Add pluggable package policy checks

[shrikant-pplx]

Motivation

Cachew knows when an immutable package body is a cold miss, so it can enforce package-admission policy before fetching from an origin. The admission contract should not couple the CodeArtifact and Go module strategies to one vendor.

What changed

• Add an optional, provider-neutral package-policy block to the CodeArtifact and Go module strategies.
• Define a small PURL-to-decision evaluator interface shared by both strategies. A future provider can implement that interface without changing registry or cache behavior.
• Add a nested socket provider with configurable api-url, organization, token, and timeout. The provider owns Socket-specific bearer authentication, request/query shape, NDJSON decoding, and policy-action mapping.
• Construct standard npm, PyPI, and canonical-version Go Package URLs and evaluate them before a cold origin fetch. Go branch and revision .info queries pass through for canonical-version resolution; the resulting module artifacts are evaluated before download.
• Return an explicit, non-cacheable 403 for deny decisions. Pending analysis and evaluator availability failures return a retryable, non-cacheable 503; neither path contacts the package origin. Provider failure causes are retained for strategy-level logs while client responses remain sanitized.
• Preserve warm-cache behavior: admitted immutable CodeArtifact bodies and cached Go module files bypass revalidation. Go uses a metadata-only warm probe and forces the subsequent request into goproxy cache-only mode so an eviction between lookups cannot fall through to origin.
• Coalesce concurrent evaluations for the same PURL into one in-flight provider call. Cachew does not retain completed decisions, so a later cold request receives a fresh verdict.
• Exclude Go modules matching private-paths from package-policy evaluation.
• Export provider- and outcome-bounded policy metrics without package names or versions as labels. Unsupported ecosystems and unrecognized or deliberately excluded request paths emit not_applicable; metadata GETs and body-admitting requests should be separated when interpreting coverage.
• Document the exact CodeArtifact cache-key preimage and the limits of the generic delete command. A complete targeted purge requires deleting every cached Accept and Accept-Encoding variant from every deployment; Cachew does not currently list or purge objects by package path or PURL.

Security and operator impact

With the Socket provider, Socket receives the ecosystem, public package name, and version. Cachew does not send package contents, CodeArtifact tokens, repository names, AWS identity, or private Go module identities.

The Socket token requires only packages:list. Configuration uses ${SOCKET_SECURITY_API_TOKEN} so deployments can inject a Kubernetes Secret-backed environment variable into the Cachew container; no token is stored in this repository or exposed to package-manager clients. The configurable Socket API must be an HTTPS origin, and redirects are not followed with credentials.

This source change does not create or modify deployment secrets. Enabling a provider remains an explicit deployment configuration change.