Add storage.cache_artifacts to serve artifacts without storing them

[DANIILSKRIPCHENKO]

Closes #385

Summary

Adds storage.cache_artifacts: false (PROXY_STORAGE_CACHE_ARTIFACTS). When enabled, artifact downloads are streamed from upstream to the client and never
written to storage or the cache database. Metadata filtering, cooldown and the denylist work as before.

Use case: running the proxy behind another cache (e.g. a remote repository in an artifact manager) purely for cooldown, without keeping a
second copy of every package.

Details

• GetOrFetchArtifact and the URL-based fetch path skip the cache lookup, request coalescing and storeArtifact. They stream the upstream
  body directly. GetCachedArtifact returns nothing.
• Artifacts whose digest is known up front (OCI blobs, Swift archives, Helm charts) are checked while they stream. These responses are sent
  chunked. On a digest mismatch the read fails and the handler aborts the connection, so the client never gets a tampered artifact as a complete
  response.
• Config validation rejects passthrough together with scanning.enabled, storage.direct_serve or mirror_api, since all three need stored
  artifacts. The mirror command refuses to run with it.
• Storage and the database are still required: metadata caching, health checks and cooldown publish times use them.

Tests

• Artifacts are streamed and not stored (nothing in storage or the DB). Existing cached entries are ignored.
• Digest verification: a matching digest streams the artifact, a mismatch fails the read, and ServeArtifact aborts with no Content-Length.
• npm download cooldown in passthrough mode: a version older than the window is served, a fresh one gets 404 and is never fetched.
• Config validation for each combination that is not allowed, plus the env var.

go test ./..., go vet ./... and golangci-lint run ./... pass.

[andrew]

Two issues need fixing before merging:

1. serveArtifact only aborts on ErrArtifactDigestMismatch, so other upstream read errors produce successful truncated responses. I reproduced this through the running proxy with an OCI blob whose upstream declared Content-Length: 100 but sent five bytes, and an npm tarball whose upstream closed a chunked response without the final chunk. Normal mode returned 502 for both. Passthrough returned 200 with Content-Length: 5, body short, and no client read error. The OCI response also retained the expected digest header without completing verification. Abort on any copy error and add HTTP tests asserting that clients see an incomplete response for both cases.

2. Swift archive HEAD requests call getCachedArtifactWithUpstreamHash directly, bypassing the passthrough guard in GetCachedArtifact. I cached a Swift archive in normal mode, restarted with passthrough enabled, and made the upstream archive return 404 while keeping its release metadata available. HEAD still returned the cached 200 and length without requesting the upstream archive; GET returned 404. Apply the passthrough guard to this cache path too and add a regression test covering an existing cache entry when passthrough is enabled.

[Markeli]

Small naming nit: passthrough is a bit ambiguous for this project. Since the whole point of the proxy is filtering, "passthrough" can easily be read as "pass everything through untouched", i.e. no cooldown and no denylist, which is the opposite of what this mode does.
passthrough is also a bit misleading in the storage section. Storage and the database stay in use: metadata is still cached there, and so are the publish times cooldown needs. Only artifacts are no longer stored.

What about naming it after what actually changes, e.g. storage.cache_artifacts (default true, PROXY_STORAGE_CACHE_ARTIFACTS)? An enum would also work, if that fits the config style better: storage.artifacts: cache | passthrough. Not a blocker, happy to go with whatever you prefer.

[DANIILSKRIPCHENKO]

Thanks for the thorough review — both issues are fixed.

1. Truncated upstream bodies (0a3ec11): serveArtifact now aborts on any read error, and when fewer bytes than the declared size were written, not only on a digest mismatch. Upstream read failures are logged and counted as stream_failed. Added HTTP tests through the handlers for an OCI blob shorter than its Content-Length and an npm tarball whose chunked response ends without the final chunk — both now reach the client as incomplete responses.

2. Swift archive HEAD (0a3ec11): the guard moved into checkCache, so every cache read path misses when artifact caching is off. Denylisted versions are still rejected. Added a regression test with an archive cached in normal mode, then HEAD and GET with caching disabled and the upstream archive returning 404.

@Markeli good call on the name — renamed to storage.cache_artifacts (default true, PROXY_STORAGE_CACHE_ARTIFACTS). The internal Proxy.Passthrough field is now StreamArtifacts (e8d26af); its zero value keeps caching on for any Proxy built outside the server config, such as mirror and tests.

I also merged current main into the branch.

[andrew]

Thanks!