Proposal: default generic upstreams for common tool download hosts #460

With #459, naming a well-known host under upstream.generic is enough for its versioned downloads to be cached as artifacts. The operator still has to list the hosts, though, while every other ecosystem works out of the box from the upstream defaults in config.Default() (npm, PyPI, Maven, …). upstream.generic starts empty, so /generic/... serves nothing until it is configured.

Proposal

Ship defaults for upstream.generic, covering what mise fetches most often:

upstream:
  generic:
    github: "https://github.com"
    github-api: "https://api.github.com"
    apache: "https://archive.apache.org"
    nodejs: "https://nodejs.org"
    golang: "https://dl.google.com/go"

Together with #459's built-in patterns, caching mise's GitHub release assets and its Maven, Node and Go downloads would need no server config, only the client-side url_replacements.

Caveats

1. Generic routing stops being opt-in. The handler docs stress that only configured upstreams are reachable, so /generic isn't an open proxy. That would still hold, but five public hosts would become reachable without the operator listing them. That's the same position as the npm and PyPI defaults, but some operators expose only selected routes and may expect /generic to stay closed.
2. Existing configs change silently. config.Load decodes YAML over Default(), and yaml.v3 merges into an existing map. Defaults placed in Default() would therefore be added alongside any user generic: entries, rather than replaced by them. That's probably what we want, but it means upgrading adds routes to deployments that already configure generic.
3. The names become public API. Clients bake /generic/github/, /generic/golang/ and so on into mise config and CI images, so the default names couldn't be renamed later. They should be agreed up front; golang vs go vs godl already varies between deployments.
4. There needs to be a way to turn a default off. For example, an empty URL (github: "") could remove that entry, and an explicit generic: {} could not clear the defaults because of the map merging in caveat 2. Whatever the mechanism, it has to cover single-entry and all-entry removal, plus the PROXY_* environment-variable path if generic upstreams are configurable there.
5. Which hosts make the list. Each default is a host the project implicitly vouches for. I'd keep it to hosts with built-in patterns (Build in version-pinned paths for well-known download hosts #459) plus GitHub, and add more only alongside their patterns.

An alternative that avoids caveats 1, 2 and 4: keep generic empty by default, but add a one-line opt-in such as upstream.generic_defaults: true that adds the set above.

Related follow-up: a config-aware mise snippet on /ui/install, generated from the configured generic upstreams and base_url, so clients don't hand-edit URLs.