feat(df): add dependency firewall engine foundations

Description

First MR in the glab dependency-firewall (alias df) stack that breaks up the POC in !3429 into smaller, independently reviewable pieces.

This MR adds the dependency-free engine foundations under internal/dependencyfirewall/ — pure library packages with full unit coverage and no user-facing command yet:

• verdict — the shared Verdict type (blocked / warning) and the Entry record (package, version, verdict, reason, status, timestamp) used by every other firewall package.
• config — load, save, and merge .gitlab/df/config.json. Configuration stores full registry URLs (repoResolve / repoDeploy).
  • RegistrySettings builds the npm settings from a full registry URL and attaches the GitLab token only when the registry host matches the logged-in GitLab host (case-insensitive, default-port aware), so the token is never sent to a third-party or public registry.
  • Merge is create-or-update, takes a managerKey so it can write any package-manager block (npm today; pnpm/yarn in later, separate MRs), and preserves unknown keys.
• npmrc — apply firewall settings to a project .npmrc and restore the original on completion (returns a Handle). The auth line is omitted when no token is configured, so public-registry installs work without a token.

Stack

MR	Targets	Contents
this	main	engine foundations (verdict, config, npmrc)
next	this	CI verdict log + summary renderer
next	this	MITM proxy + classifier (parallel)
…	…	df commands, then the df npm wrapper

Related Issues

• gitlab-org/gitlab#603648+s
• MRs split out from Draft: POC feat(df): add GitLab Dependency Fire... (!3429) • Michael Eddington

How has this been tested?

Pure library code; no GitLab instance required.

go test ./internal/dependencyfirewall/verdict/... \
        ./internal/dependencyfirewall/config/... \
        ./internal/dependencyfirewall/npmrc/...

Coverage includes: full-URL parsing and validation, host-scoped auth (token withheld from a non-matching/public registry host, case-insensitive host match, default-port equivalence), Merge create-or-update across named manager blocks with unknown-key preservation, and the .npmrc auth line being omitted when no token is set. All three packages pass; make lint is clean. End-to-end behavior is exercised by the later MRs in the stack (the df npm wrapper).