Add Go module proxy support

[timReynolds]

Summary

Adds first-class Go module proxy support so Vouch can sit in front of https://proxy.golang.org using the standard GOPROXY URL space.

The new go ecosystem adapter understands the official module proxy endpoints:

• /{module}/@v/list
• /{module}/@v/{version}.info
• /{module}/@v/{version}.mod
• /{module}/@v/{version}.zip
• /{module}/@latest

It uses golang.org/x/mod/module for Go's case-encoded module and version path elements, and uses the .info timestamp as the publish time sidecar for cooldown checks on .zip downloads.

Why

Vouch did not previously have a tracked Go ecosystem adapter, so enabling a go ecosystem in config failed at adapter registration. This aligns Vouch with the protocol exposed by proxy.golang.org and lets operators configure clients with, for example:

GOPROXY=http://127.0.0.1:18080/go/ go mod download golang.org/x/mod@v0.35.0

Notes

Go proxy responses do not expose a registry-provided artifact digest in the proxy protocol itself. The default policy now treats Go blobs as a protocol-specific exception for Vouch's registry-hash requirement, while still applying cooldown based on .info publish time. This leaves checksum validation to the Go toolchain and its checksum database behavior.

Blob cache writes are also guarded so artifacts without a native registry digest are served but not inserted into the digest-indexed blob cache.

Included Changes

• Adds internal/ecosystem/gomod adapter and tests.
• Registers the go ecosystem adapter in the server.
• Adds default/example config entries for go with upstream https://proxy.golang.org/ and path prefix /go/.
• Documents Go module client usage in the README.
• Adds server and policy tests for Go .zip cooldown behavior without registry hash metadata.

Validation

go test ./...