Add Helm chart and legacy requirements support

[andrew]

manifests.Parse("Chart.yaml", ...) and manifests.Parse("Chart.lock", ...) currently return UnknownFileError. Add Helm parsers for both files. Helm's chart documentation defines the Chart.yaml fields and dependency rules. The Helm source also provides the canonical Metadata structure and the Dependency and Lock structures.

For Chart.yaml:

• Return a helm manifest with the chart's name and version in ParseResult.
• Return every entry in dependencies as a direct runtime dependency. Preserve the dependency's name, version constraint, and repository value.
• Keep the declared chart name as the package identity when an alias is present. The alias changes how Helm addresses an instance of the chart, not which chart package it fetches.
• Preserve HTTP, OCI, file://, downloader-plugin, and repository-alias values without trying to resolve them. Repository aliases such as @repo-name and alias:repo-name depend on Helm's local repository configuration, which is outside a pure single-file parse.
• Do not filter dependencies based on condition or tags. Their values are evaluated against a release's values at install time.

Helm's OCI documentation shows the repository form used for OCI dependencies. The Helm test data has a chart and lockfile pair with a local repository, plus dependencies with conditions and tags.

For Chart.lock:

• Return a helm lockfile with its resolved dependency names, exact versions, and repositories. These entries are direct dependencies.
• Preserve the top-level digest on the parse result. The digest covers the dependency declarations from Chart.yaml; it is not the digest of each downloaded chart and must not be copied into every dependency's Integrity field. Add a result-level field if needed.
• Ignore generated for package identity and dependency comparison. It records when Helm wrote the lockfile.

Generated PURLs should follow the accepted pkg:helm definition. The type proposal is still open as package-url/purl-spec#236, so this work should not invent a different name, namespace, or qualifier mapping.

Add parser registration, unit tests, fixtures, and README entries. Tests should cover an HTTP repository, an OCI repository, repository and chart aliases, version constraints, conditions and tags, a chart with no dependencies, resolved lockfile versions, the lockfile digest, the generated timestamp, missing optional fields, and malformed YAML.

Legacy Helm formats

Include the Helm v2 dependency files in the same parser work:

• Parse declarations from requirements.yaml.
• Parse resolved dependencies from requirements.lock.

Keep the declaration and lockfile behavior aligned with Chart.yaml and Chart.lock while preserving the legacy filenames and file types.