Add helm local repositories (#140)

In-house charts have nowhere to publish: a helm local stores uploads but serves no index.yaml, and the helm virtual merger drops every chart field except name/version/urls.

- add helm local uploads (`PUT .../files/<name>-<version>.tgz`) recording each Chart.yaml in a new `helm_metadata` table; mismatched filenames stay out of the index
- bound chart parsing (50MiB decompressed, 10k entries, 1MiB Chart.yaml)
- generate a deterministic `index.yaml` with sha256 digests and path-escaped relative urls
- keep all chart fields when merging helm virtual indexes, expanding YAML aliases
- add a real-helm e2e-docker test, UI snippet and README section

Reviewed-on: #140
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

README.md

@@ -262,6 +262,22 @@ there's nothing to provision. To bring your own key instead, point
 `TF_SIGNING_KEY_PASSPHRASE`), which takes precedence over the generated one.
 `TF_PROVIDER_PROTOCOLS` (default `5.0,6.0`) sets the advertised plugin protocols.
 
+### Local helm repository
+
+A local `helm` repo is a real chart repository: `PUT` a packaged chart to
+`/api/v2/remotes/<repo>/files/<chart>-<version>.tgz` and `index.yaml` is
+generated from each chart's `Chart.yaml` (with sha256 digests) at
+`/api/v1/local/<repo>/index.yaml`; a file not named after its `Chart.yaml`
+name and version is stored but left out of the index. Add the local as a
+member of a helm virtual to serve it alongside remotes.
+
+```bash
+helm package ./mychart
+curl -fsSL --upload-file mychart-0.1.0.tgz \
+  https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/<repo>/files/mychart-0.1.0.tgz
+helm repo add <repo> https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/<repo>
+```
+
 ### Local puppet forge
 
 A local `puppet` repo is a Forge: `PUT` a module tarball to