Fix UNGM scraper/parser

[andreighh]

UNGM changed its site and the UNGM scraper stopped importing tenders:

• the notice search now requires an ASP.NET anti-forgery token;
• the markup of the result list and the notice pages changed.

Contract awards (add_award) were broken too:

• the award search moved to a new endpoint;
• save_award crashed on every award, so awards had never been saved.

Changes

Tender search and parsing (app/server_requests.py, app/parsers/ungm.py)

• Load the search page and send the POST in one requests.Session, returning the __RequestVerificationToken in the RequestVerificationToken header.
• The search payload now matches the site's: the new fields, UNSPSC IDs sent as numbers, NoticeTASStatus dropped. The UNSPSC filter still works the same way.
• Use the same current Firefox headers for GET and POST, add timeouts to every UNGM request, and back off longer between retries.
• Pause 2–5 s between notice requests, and skip a notice that fails to load instead of crashing the run.
• Parse list rows by tableCell instead of positions in .contents, and limit notice parsing to #noticeDetail (the menu reuses status-tag).

Contract awards (app/management/commands/add_award.py)

• Search through /Public/ContractAward/PublicSearch with the site's current payload.
• Only consider UNGM tenders whose deadline passed in the last 90 days and that have no award yet, and pause between requests. Each tender costs at least 3 requests, and without the window
  the same old tenders were searched again on every run.
• Keep only results whose reference exactly matches the tender's (UNGM's filter also matches partially). Fetch every matching award (one per lot) and merge them into one Award, as TED and
  IUCN do: summed value, all vendors, latest date.
• Fix save_award: it called .save() on the update_or_create tuple. Store a missing contract value as None instead of '', and normalize vendor names with transform_vendor_name.
• The help text now explains that the command only handles UNGM; TED and IUCN awards come in through their own scrapers.