Import an apt repository's packages into a hosted apt repository #644

Once Forge serves apt repositories (#176), an apt hosted repository should be fillable by an import. This builds on #642, which makes the import read its source through the format's own protocol, and adds an apt source. Of all the formats, apt's protocol lists the most: every file with its size and SHA-256.

Source: an apt repository

The source is a repository's base URL plus a distribution. For Nexus, that is <nexus>/repository/<name>/ and the distribution its apt hosted repository is configured with.

• Release: dists/<dist>/InRelease (or Release) gives the components, the architectures and the checksums of the indexes. If the import is given the source's public key, InRelease is verified against it; the key is optional, since Forge re-signs with its own key.
• Packages: dists/<dist>/<component>/binary-<arch>/Packages (.xz or .gz) lists every .deb with its Filename, Size and SHA256. Each index is checked against the checksum Release gives for it.
• Copy:
  • Each .deb is downloaded from <base>/<Filename>, verified against its size and SHA-256, and written into the hosted repository under its component.
  • A .deb that Forge already holds with the same SHA-256 is skipped without a download, so a re-run copies only what is new.
• Metadata: apt's indexes carry no publish time, so the creation time is the import time (Decide whether an import from a Nexus also reads Nexus' REST API for checksums, last downloads and uploaders #645 decides whether an import from a Nexus reads its REST API on top). A version with no last download counts as downloaded at import time, as in Import through the format's own protocol (a NuGet feed, a registry's catalog) instead of Nexus' REST API, named neutrally #642.
• Out of scope: source packages (Sources) and debian-installer udebs.

Acceptance criteria

• e2e against a real Nexus 3 apt hosted repository with packages for two architectures, followed by apt-get install from Forge in a debian:bookworm container.
• e2e against a static apt repository served from files (made with dpkg-scanpackages / apt-ftparchive).
• A Packages entry whose size or SHA-256 does not match its .deb fails that item, and an index that does not match Release fails the scan.
• The web UI offers the import on apt hosted repositories, and the docs describe the apt source. Changelog fragment: feature.