feat(df): fail closed on unparseable in-scope proxy traffic

Applies the unparseableMatch fail-closed pattern to the gem, npm, pypi and maven proxy matchers. When a request is clearly a package fetch or publish for its ecosystem but its coordinate can't be extracted, the matcher blocks it instead of forwarding it unchecked.

The matchers see every request in a package-manager session, not only registry traffic, so "in scope" is drawn narrowly:

• npm/pnpm/yarn: a PUT is a publish only when its body is a JSON object with _attachments. A JSON object that can't be decoded fails closed. Metadata writes (dist-tag, owner, star, team, legacy adduser, deprecate) and non-JSON uploads are forwarded.
• maven/gradle: a .jar/.pom/.aar/.war fails closed only when its filename names the directory's artifact with a different version. Downloads outside the repository layout (GitHub release jars, Ivy repositories, tool jars) are forwarded.
• gem: a .gem directly under gems/ whose filename has no version fails closed.
• pypi: a multipart upload to /legacy/ with no name field fails closed.

Behaviour changes from main: npm deprecate/unpublish PUTs are no longer policy-checked, and an npm publish must carry exactly one version. npm publish bodies larger than the 64 MiB in-memory window are read from the spill file in full rather than from a truncated prefix, with keys matched case-sensitively as the registry does.