[deckhouse-cli] mirror: add packages mirroring support

[ldmonster]

Summary

Adds packages mirroring to d8 mirror pull / push, parallel to the existing modules support.

Packages follow the same registry structure as modules, but under different path segments:

	Modules	Packages
Catalog	…/modules	…/packages
Main image	…/modules/<name>:<ver>	…/packages/<name>:<ver>
Release images	…/modules/<name>/release	…/packages/<name>/version
Extras	…/modules/<name>/extra/<n>	…/packages/<name>/extra/<n>

New archives produced

• package-<name>.tar — one per package, full content (main image + version channel images + extra images). Identical structure to module-<name>.tar.
• package-versions.tar — aggregates the version/ release images of all packages into a single archive. Produced on every mirror pull, regardless of which components are mirrored or whether --no-packages is set — so the package release catalog is always cloned into the bundle.

New CLI flags (d8 mirror pull)

--include-package <name>[@constraint]   whitelist packages (same constraint dialect as --include-module)
--exclude-package <name>[@constraint]   blacklist packages
--no-packages                           skip per-package pull (package-versions.tar is still produced)
--packages-path-suffix                  registry path suffix (default /packages)

--include-package and --exclude-package are mutually exclusive.

New files (separate package, matching existing layout conventions)

• internal/mirror/packages/packages.go — pull pipeline (discovery, channel/version/extra/vex images, channel-alias propagation, per-package packing)
• internal/mirror/packages/layout.go — OCI layout structs

Other changes

• pkg/libmirror/bundle/bundle.go — added PackSourcesWithPrefix (multi-source tar packer used for package-versions) and PackSource.ExcludeDirs walk option; PackWithPrefix delegates to it, no callers changed.
• pkg/registry/service/package_service.go — PackagesService / PackageService / PackageVersionService (mirror of module service with version segment).
• pkg/libmirror/bundle/validation.go — MandatoryLayoutsForPackage.
• internal/mirror/push.go — createPackagesIndex for post-push discovery.
• internal/layout.go, internal/mirror.go — PackagesSegment, PackagesVersionSegment, MirrorTypePackages* constants.
• pkg/libmirror/operations/params — SkipPackages, PackagesPathSuffix fields.

Design notes

• Packages reuse the modules version-selection vocabulary (Filter, Module, VersionConstraint, ProbeAvailableVersions) rather than duplicating it — the same pattern already used by platform.
• Registries without a packages catalog degrade gracefully (warn + skip), so this never interrupts platform/security/modules mirroring.
• Release images are intentionally duplicated between package-<name>.tar and package-versions.tar; the per-package archive stays fully self-contained.