Add Alpine APK repository metadata support

[andrew]

Version: git-pkgs/registries current main at 418e68a.

Trying to create an Alpine repository client after importing all registries currently returns unknown ecosystem: apk:

_, err := registries.New("apk", "https://dl-cdn.alpinelinux.org/alpine/v3.23/main/x86_64", nil)

Add an apk registry that reads both Alpine repository index formats. Apk-tools defines the repository layout as $base_url/$arch/APKINDEX.tar.gz for v2 and $base_url/$arch/Packages.adb for v3. Accept either a concrete architecture directory or an exact index URL. For a directory, try Packages.adb first and fall back to APKINDEX.tar.gz only on a not-found response. Do not guess a release, repository component, or architecture from a higher-level mirror URL.

There is no default APK repository. Register an empty default and make core.New return a clear error when the URL is missing. A PURL such as pkg:apk/alpine/curl@7.83.0-r0?arch=x86_64 uses the vendor namespace and architecture defined by the apk type. When called through NewFromPURL, split the full name alpine/curl for index lookup while retaining alpine as Package.Namespace.

For v2, open APKINDEX.tar.gz, read the APKINDEX member, and parse its blank-line-separated records. Apk-tools maps the legacy fields to package data in apk_adb.c. The current Alpine v3.23 main/x86_64 index is a real example.

For v3, decode the ADB index root and package records written by apk mkndx. Read signed and unsigned index blocks, but leave signature trust checks outside this metadata client. Coordinate the low-level ADB decoder with git-pkgs/archives#30, while treating Packages.adb as an index schema rather than an archive file tree. Commit a small generated v3 index fixture so tests do not depend on an unreleased or moving public repository.

Map name, version, description, project URL, license, architecture, build time, maintainer, installed and file sizes, origin, dependencies, provides, replaces, install-if rules, repository commit, and package hashes. FetchDependencies should return ordinary D dependencies as runtime dependencies while preserving virtual provides and the other relationship types in metadata. Parse a maintainer in Name <email> form without losing an unstructured value.

Resolve package downloads using the index pkgname-spec when v3 supplies one, otherwise use <name>-<version>.apk beside the index as described by apk-tools. Decode the legacy Q1 package checksum and expose its algorithm explicitly rather than treating it as SHA-256. Preserve v3 hash algorithms and normalize supported values to the algorithm-hex form used by Version.Integrity.

Follow the new ecosystem layout, register the package from all/all.go, and add it to the root ecosystem tests.

Tests should cover v2 and v3 indexes, signed v3 indexes, two configured architectures, exact apk versions including -r revisions, vendor namespaces, package URL construction, dependencies and virtual provides, checksums, missing optional fields, malformed and truncated indexes, a missing configured URL, authentication through the supplied HTTP client, and not-found packages and versions.