harden rpm virtual redirects, fail closed, keep data files resolvable

- reject absolute and dot-segment member paths, escape the target, keep the query
- return 502 when any member's repodata can't be fetched
- serve recently merged data files by hash for 5m after repomd changes
- fold xml:base under a member upstream into the virtual href

internal/api/v1/proxy.go

@@ -162,7 +162,12 @@ func (h *ProxyHandler) handleVirtual(w http.ResponseWriter, r *http.Request) {
 
 	proxyBaseURL := fmt.Sprintf("%s://%s", scheme(r), r.Host)
 
-	if loc, ok := h.virtualEngine.MemberRedirect(r.Context(), *virt, path, proxyBaseURL); ok {
+	loc, ok, err := h.virtualEngine.MemberRedirect(r.Context(), *virt, path, r.URL.RawQuery, proxyBaseURL)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	if ok {
 		http.Redirect(w, r, loc, http.StatusFound)
 		return
 	}