Add cooldown period to version resolution

[wagoodman]

Add a configurable release cooldown feature to protect against supply chain attacks. This implements a time-based buffer between when a tool version is published upstream and when binny will install it, giving time for malicious releases to be detected and pulled.

Closes #230

Changes

• Add global cooldown configuration option (e.g., cooldown: 7d) that applies to all tools
• Add per-tool version.cooldown override to customize or disable cooldown for specific tools
• Add --ignore-cooldown CLI flag for install and update commands to bypass the check when needed
• Implement cooldown enforcement in github-release and go-proxy version resolvers
• Add CooldownError type with helpful error messages showing version age, cooldown duration, and time remaining
• Support human-friendly duration parsing (e.g., 7d, 3d, 168h)

How It Works

When resolving the latest version, the resolvers now check the publish date of each candidate release:

• github-release: Uses the GitHub releases API to fetch publish timestamps
• go-proxy: Fetches version info from proxy.golang.org/@v/{version}.info endpoint
• git: Does not support cooldown (logs a warning if configured)

If no version satisfies the cooldown period, a CooldownError is returned with actionable information about when the user can try again.

Configuration Examples

# Global cooldown for all tools
cooldown: 7d
tools:
  - name: gh
    version:
      want: latest

# Per-tool override
cooldown: 7d
tools:
  - name: gh
    version:
      want: latest
      cooldown: 3d  # shorter cooldown for this tool
  - name: critical-tool
    version:
      want: latest
      cooldown: 0   # disable cooldown for this tool

[kzantow]

Is there a reason the git resolver doesn't support this? I'd think it could, acknowledging commit times can be forged, but they shouldn't be able to be forged in all cases, such as using squash commits in GitHub.

[wagoodman]

I thought about it and also was looking at commit times, but it didn't seem practical on a first pass from a security perspective. (We can always add this later)