Add a Swift package registry client

[andrew]

Closes #96

Adds a swift registry for the SE-0292 registry API. There is no default registry, so registries.New("swift", "", nil) returns the existing "no registry URL configured" error, as Helm does.

• FetchVersions lists GET /{scope}/{name}, following Link: rel="next" pages on the registry's own host (up to 50). Releases with a problem are marked yanked. It doesn't fetch each release, so versions have no time or checksum.
• FetchVersion reads GET /{scope}/{name}/{version} and returns the source-archive checksum as sha256-<hex> integrity, originalPublicationTime or publishedAt, and the archive as an Artifact. FetchVersionFromPURL uses it.
• FetchPackage and FetchMaintainers read the latest available release's metadata. FetchDependencies returns nil, since dependencies are only in Package.swift.
• URLs().Download builds /{scope}/{name}/{version}.zip, so fetch.Resolver resolves Swift without a metadata request.
• 404 and 410 map to NotFoundError.

Names are scope/name, the PURL namespace and name as git-pkgs/proxy's Swift handler already writes them (pkg:swift/apple/swift-nio), or the registry identifier scope.name. Both are checked against the spec's scope and name rules before any request. A host-style namespace like pkg:swift/github.com/apple/swift-argument-parser is rejected, because the API has no way to map a source host to a scope. Starting strict leaves room to add a mapping later without changing what existing names resolve to.

The registry API expects Accept: application/vnd.swift.registry.v1+json and paginates through Link headers, and client.Client hard-coded Accept: application/json and didn't expose response headers. GetJSONWithHeaders adds both without changing the existing methods.

Against https://tuist.dev/api/registry/swift (git-pkgs/proxy's default Swift upstream), apple/swift-nio lists 194 versions, 2.65.0 resolves with a checksum that matches the downloaded zip's sha256, and missing packages and versions return NotFoundError. That registry omits metadata and publishedAt, so those fields are optional here.

https://claude.ai/code/session_01NxsA75HBjdWQKcdx7FDTDc

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.