feat: deb (Debian/apt) local and remote repository support

Adds a deb provider with feature parity to rpm for local and remote repos,
so .deb packages can be hosted (flat apt repo generated on upload) and a
Debian/Ubuntu mirror can be cached through the proxy.

- add PackageDeb to the package-type enum
- new internal/provider/deb: Classify (.deb immutable, Packages/Release/dists
  mutable), ValidateUpload to pool/<file>, pure-Go .deb parse (ar -> control.tar
  gz/xz/zst -> ./control), and a flat-repo LocalIndexer serving Packages,
  Packages.gz and an unsigned Release ([trusted=yes], mirroring rpm gpgcheck=0)
- remote proxy path: UpstreamURL/ContentType/AuthHeaders via BasicHeaders
- DebMetadata struct + store interfaces on provider; deb_metadata table in
  migrate() and Insert/Delete/List DB methods
- blank-import the deb provider in the server
- testsupport.MinimalDeb pure-Go fixture builder
- unit tests (classify, control parse across gz/xz/zst, Packages/Release
  generation, validate) and a dockere2e TestLocalDebRepo

internal/provider/rpm/github_test.go

@@ -47,6 +47,9 @@ func (f *fakeStore) DeleteRPMMetadata(_ context.Context, _, filePath string) err
 	return nil
 }
 
+func (f *fakeStore) InsertDebMetadata(context.Context, *provider.DebMetadata) error { return nil }
+func (f *fakeStore) DeleteDebMetadata(context.Context, string, string) error        { return nil }
+
 func (f *fakeStore) ListRPMMetadataEntries(ctx context.Context, _ string) ([]provider.RPMMetadata, error) {
 	// Mirror pgx: a canceled/expired context fails the read. This is what
 	// poisons the repodata response if the read runs on the inbound request.