Spec 0009 D5. Supplies NewProviderAt, so the harness can point this provider at
a server it controls and prove each refusal is named with the right sentinel.

Also declares MissingTag, which the fixture now 404s, so the release-not-found
sentinel on GetReleaseByTag is checked rather than assumed.

The harness accepts either not-found sentinel on a bare 404, which is what lets
D4 stand: this provider reports a 404 from its release listing as ErrNotFound,
because a missing PROJECT is what that status means there, and keeps
ErrReleaseNotFound for a project that exists with no releases. That distinction
is pinned by this module's own tests; the shared checks pin only that a 404
carries one of the two.

Requires forge v0.14.0 for NewProviderAt.

Spec 0008 D4. forge has exposed WithHTTPTransport and WithHTTPClient since
v0.13.0 and this adapter read neither: the factory took opts ...forge.Option,
consulted Options.Logger, and dropped the rest. A consumer injecting a transport
to share a connection pool got no effect and no error.

Settings gains HTTPTransport and HTTPClient, the factory copies them from the
options, and client construction goes through one of two helpers:

  - apiClient honours both rungs, preferring a supplied client, which is the
    precedence forge.Options documents.
  - pooledClient shares a supplied transport and DELIBERATELY IGNORES a supplied
    client. newDownloadClient is now built on it, keeping its sensitive-header
    policy and gaining the shared pool.

This adapter is the one in the family that cannot fall back on the standard
library. Go strips only Authorization, Cookie and WWW-Authenticate across a
cross-host redirect; GitLab's credential is the custom header PRIVATE-TOKEN,
which would follow an object-storage 302 — or an open redirect on the instance —
straight off the pinned host. newDownloadClient registers it as sensitive
precisely to stop that, and that policy lives on a client rather than on a
transport.

A supplied client carries the caller's policy, not that one. Using it for the
download would put this provider's own credential on the wire to whatever host a
release author's asset URL resolves to, which is the leak
TestDownloadReleaseAsset_TokenNotForwardedAcrossRedirect exists to prevent. The
transport is still shared, so no pooling is lost.

Every behaviour is falsified against the mutant that removes it, including
newDownloadClient losing the shared pool, which is caught by
TestTheDownloadStillSharesTheInjectedTransport rather than by any security test —
the two halves are independent and both are pinned.