fix(composer): resolve *-dev versions from the ~dev metadata file

[wickedOne]

Disclosure

this pr was created using claude opus. i'm a php developer and think i understand most of the changes but prolly can't defend some (e.g the net/* requirements in the test). the issue was that the proxy could not cache -dev packages and this appears to fix it without breaking the non -dev caching for composer...

Summary

Composer dev dependencies (e.g. 3.x-dev, dev-master) could not be installed
from dist through the proxy. The download handler only ever fetched the regular
{vendor}/{package}.json metadata file, but Packagist serves development
versions from a separate {vendor}/{package}~dev.json file. As a result the
dist URL was never found, the handler returned 404, and Composer silently fell
back to a full git clone.

What changed

• handleDownload now consults both metadata files. The file most likely to
  contain the requested version is tried first, with the other as a fallback:
  • dev versions → ~dev file first, then the regular file
  • tagged releases → regular file first, then the ~dev file
• Added isDevVersion to classify Composer version strings
  (dev-<branch> / <alias>-dev).
• Added metadataURLsForVersion to build the ordered list of candidate
  metadata URLs.
• Extracted the metadata fetch/parse/lookup logic into
  findDownloadURLFromMetadata. A missing document (non-200) or a missing
  version now yields an empty string so the caller can fall back to the other
  file; only transport failures return an error.

Testing

• Added TestComposerDownloadDevVersionUsesDevMetadata, a regression test that
  serves both metadata files from a mock upstream and asserts that:
  • the old behavior (regular file only) cannot resolve a dev version, and
  • the fixed behavior (consulting the ~dev file first) resolves the correct
    dist URL.

[andrew]

Verified the bug against live Packagist and traced the request path end to end. The fix is correct and the refactor is clean. The net/http / httptest imports in the test are the standard way to mock an upstream server in Go, nothing to worry about there. Thanks for the contribution.