cooldown: add package pattern overrides

[ksivamuthu-cei]

Summary

Add proxy-level cooldown package-pattern overrides as a policy wrapper, without changing the cooldown library.

• add internal/cooldownpolicy, implementing the handler cooldown policy interface;
• apply duration overrides for canonical PURL globs, with exact package overrides taking precedence;
• normalize @ to %40 in configured patterns, matching canonical PURL lookup behavior;
• validate glob patterns and durations when starting the server; and
• document cooldown.package_patterns.

This is an initial policy layer for #127 and keeps namespace matching independent from the cooldown library, so it can later support other package-filtering policies.

Validation

• go test ./...
• go vet ./...
• go build ./cmd/proxy

[andrew]

Both pkg:npm/@example/* and pkg:npm/%40example/* normalize to the same glob, but both entries remain in the sorted pattern list. If their durations differ, nondeterministic map iteration controls which entry matches first, so the same configuration can allow or block a package across restarts. Please deduplicate normalized globs with deterministic precedence, or reject conflicting entries, and add a collision test.