Bitbucket Cloud WITHDREW snippets: GET /2.0/snippets answers 410 Gone with
"CHANGE-2770 - Functionality has been deprecated". This is not a capability
nobody wired up but one Atlassian removed, and it is not coming back — the same
trajectory as Issues.

The test exists to stop someone adding a stub that returns ErrNotSupported from
every method. That looks helpful and is worse than absence: it makes the
provider advertise a capability the forge cannot honour, and defeats the type
assertion callers branch on to decide whether to fall back.

Compatibility note: requires forge v0.11.0, which introduces forge.Snippets.

Implements spec 0007 D2:
0007 snippets and gists

A handle cannot own or enforce copyright, and the estate was
split between two holder strings. Names both so the notice
identifies a legal person without orphaning the handle.

Migrates to forge v0.12.0, whose ProviderFactory takes an Endpoint rather
than a ReleaseSourceConfig. SettingsFromConfig takes the ROOT
configuration and resolves its own section from the endpoint, so a named
source reads bitbucket.<name> rather than sharing the default source's
keys. The keychain reference is read from that same section, because it
is one of the source's settings — a named source pointing at its own
keychain entry would otherwise be handed the default source's.

filename_pattern moves from ReleaseSource.Params into that section,
beside the credential keys it is configured with.

The private-repository check moves from construction to the operation.
It used to run in NewReleaseProvider from a Private flag carried on the
address, and a connection serves public and private repositories alike —
so the flag was describing a repository through a connection-shaped hole
and could only ever be as accurate as whatever the caller declared.
Refusing to construct also denied the public case whenever someone set
the flag hopefully.

At the operation the answer is known rather than declared: the API has
refused, and this provider knows whether it sent anything. The hint is
carried over unchanged, because the advice was never the problem — only
where it was decided. A refusal WITH a credential deliberately gets no
such hint: that is a permissions or rate-limit answer, and telling the
caller to set variables they already set sends them the wrong way. Both
halves are tested.

The factory sets Endpoint.Type from its registration rather than trusting
or defaulting it, matching the sibling adapters: the type selects the
configuration subtree, so a caller passing another provider's type would
otherwise make this provider read that provider's credential.

Implements forge spec 0008 D1, D2 and D8 for this adapter.