refactor: use provider name as canonical DB foreign key

[coopernetes]

closes #188

Summary

Provider FK refactor:

• GitProxyProvider.getProviderId() now returns getName() instead of type/host
• ProviderRegistry.resolveProvider() simplified — type/host fallback removed
• JettyConfigurationBuilder: removed redundant duplicate-detection map, updated error messages
• ProfileController + UserController: removed the provider.replace('@', '/') decode hack
• api.ts: removed providerToPathKey and its call sites — provider names are safe in URL path segments
• New tests: two-provider same-type scenario (github + internal-github sharing type=github with different hostnames)

Container scan fixes (both workflows):

• Pre-install our checksum-verified grype binary before anchore/scan-action runs — drops grype-version so scan-action uses the PATH binary instead of downloading grype's install.sh from main (which constructs invalid release tag URLs and 404s)
• Bumped grype to 0.112.0 in both container-scan.yml and docker-publish.yml
• docker-publish.yml: removed the broken find /opt/hostedtoolcache/grype step that was silently failing

Data migration (run before deploying)

The following SQL renames existing type/host values to provider names. Adjust pairs to match your git-proxy.yml.

To find what's currently stored:

SELECT DISTINCT provider FROM push_records;
SELECT DISTINCT provider FROM user_scm_identities;

For a standard single-GitHub deployment (github/github.com → github):

-- user_scm_identities and scm_token_cache have composite PKs that include provider,
-- so they need insert+delete rather than a plain UPDATE.

INSERT INTO user_scm_identities (username, provider, scm_username, verified, source)
    SELECT username, 'github', scm_username, verified, source
    FROM user_scm_identities WHERE provider = 'github/github.com';
DELETE FROM user_scm_identities WHERE provider = 'github/github.com';

INSERT INTO scm_token_cache (token_hash, provider, username, cached_at, expires_at)
    SELECT token_hash, 'github', username, cached_at, expires_at
    FROM scm_token_cache WHERE provider = 'github/github.com';
DELETE FROM scm_token_cache WHERE provider = 'github/github.com';

UPDATE repo_permissions  SET provider = 'github' WHERE provider = 'github/github.com';
UPDATE access_rules      SET provider = 'github' WHERE provider = 'github/github.com';
UPDATE push_records      SET provider = 'github' WHERE provider = 'github/github.com';
UPDATE fetch_records     SET provider = 'github' WHERE provider = 'github/github.com';

For additional providers repeat the block with the appropriate pair (e.g. gitlab/gitlab.com → gitlab). A parameterised template is in scripts/migrate-provider-ids.sql.

Test plan

• All unit tests pass (./gradlew test)
• Run data migration SQL against DB before starting new version
• Push through proxy; confirm push_records.provider shows github (not github/github.com)
• Add/remove SCM identity on profile page; confirm no @ encoding in URL
• Container scan passes on tag push; confirm latest is only updated after scan clears