Migrates to forge v0.12.0, whose ProviderFactory takes an Endpoint rather
than a ReleaseSourceConfig. SettingsFromConfig takes the ROOT
configuration and resolves its own section from the endpoint, so a named
source reads gitlab.<name> rather than sharing the default source's keys.

The factory sets Endpoint.Type from its registration rather than trusting
or defaulting it, matching the sibling adapters: the type selects the
configuration subtree, so a caller passing another provider's type would
otherwise make this provider read that provider's credential.

Nothing in the two-client arrangement changes. The API client and the
download client are built as before, and newDownloadClient still registers
PRIVATE-TOKEN as a sensitive header so the token cannot follow an
object-storage 302 — or an open redirect on a self-hosted instance — off
the pinned host. The existing pin suite passes untouched: the foreign-host
case, the redirect case, the scheme-downgrade case and the bare-host
normalisation case.

Section scoping matters here beyond tidiness, and there is a test for why.
The PRIVATE-TOKEN pin trusts a URL only when it matches this provider's
own API base, and that base comes from the section's url.api. Two sources
sharing one section would therefore share one pin, making a self-hosted
instance's token attachable to gitlab.com URLs and the reverse. Separate
sections keep each pin, and each token, its own.

Implements forge spec 0008 D1 and D2 for this adapter.