Respect disabled hostRules (enabled: false) globally in datasources and lockfile updates

[loganprice]

Tell us more.

In airgapped or strictly controlled internal network environments, Renovate has no access to public internet registries (such as api.nuget.org, registry.npmjs.org, or pypi.org).

Currently, users can configure hostRules with enabled: false to block traffic to these public registries. While this blocks outbound requests at the HTTP layer, it still leads to lookup warnings, noisy error logs, and package manager restore failures because:

1. Datasources still resolve and attempt to query the disabled default public registries.
2. Ecosystem managers (like NuGet, npm, and Python) dynamically rebuild credentials or configuration files (like nuget.config, .npmrc, or keyring environment variables) that hardcode or reference these disabled hosts, causing the lockfile generation tools (dotnet restore, npm install, pipenv lock, etc.) to attempt to connect to them.

Proposed Solution: Introduce a helper isRegistryDisabled(url, hostType) to check hostRules and apply it to:

• Datasources Globally: Filter out disabled registries in resolveRegistryUrls so lookups are never attempted against them.
• Ecosystem Managers (NuGet, npm, Pipenv, Poetry, pip-compile): Ensure that dynamically generated config files and environment variables filter out and skip disabled registries, allowing lockfile updates to succeed cleanly using only the internal, enabled mirrors.