Splice local versions into metadata responses #134

After #133 an operator can upload a package version into the proxy, but resolvers won't see it because the proxy still serves the upstream's version list unchanged.

Each handler's metadata path should look up locally-stored versions for the requested package and append them to the upstream response before serving it. If a local version has the same number as an upstream one, the local copy wins.

The nine handlers that already parse metadata for cooldown (npm, Composer, PyPI, Cargo, pub, NuGet, Hex, RubyGems, Conda) have the encode/decode in place; they need a proxy.LocalVersions(ecosystem, name) lookup and an append step. The remaining ecosystems need the same metadata parsing that #132 tracks, so this and #132 share a backlog.

The splice layer should take a generic list of extra entries (version, filename, sha256, download URL) so that future work like fork name-mapping can feed the same code path from a different source.

Depends on #133.