Add cooldown package pattern overrides

[andrew]

Add cooldown.package_patterns so operators can set cooldown durations for package families, such as exempting an npm scope with pkg:npm/@example/*. Exact package overrides take precedence over patterns, followed by ecosystem overrides and the global default.

Keep pattern matching in the proxy and apply duration selection at the existing cooldown enforcement points, including NuGet metadata and downloads. Support * and ? wildcards that do not cross / separators. Reject character classes and backslash escapes before normalizing @ to %40, so normalization cannot change which packages a pattern matches. Validate durations, reject conflicting aliases at startup, and document the order used when multiple patterns match. A cooldown exemption still respects the version denylist.

Expose the library's full Evaluate decision, including the effective duration, eligibility time and reason, and use it for IsAllowed. This provides the policy result needed by the pending-cooldown report in #338. Publication-time persistence and consistent enforcement on cached downloads remain follow-up work there.

This wrapper is a step toward the general version filter in #127. Namespace blocking in #128 needs recursive matching and rejection before upstream access; cooldown patterns use non-recursive wildcards. Filtering support for additional ecosystems is tracked separately in #132.

Replaces #243, building on its policy wrapper and addressing the normalized-pattern collision finding.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.