resolver: implement URL template substitution + conditional data block

[kurtseifried]

Summary

Phase 2.5(a) — fixes the two highest-impact bugs in the Python Server-API resolver, both surfaced by SecID-Client-SDK PR #4's conformance suite.

Bug 1: URL templates pass through unrendered

`{id}`, `{num}`, `{parent}`, `{sub}` placeholders reach clients literally instead of being substituted. Affected 4 conformance fixtures.

Bug 2: `data` block leaks on URL-bearing results

Every URL result dumped internal registry metadata (description, examples, schema info) into the response. The canonical Worker only includes `data` when there's no URL.

Implementation

New `_substitute_url_template(template, child_data, captured_input)` helper. Two layered modes mirroring SecID-Service:

Mode 1 — explicit variables:
```json
"variables": {
"num": { "extract": "^CWE-(\d+)$" }
}
```
Extract regex matched against input; group 1 supplies the value.

Mode 2 — implicit `{id}`:
Defaults to the captured input. Layered on top of Mode 1, not exclusive.

Unrecognized `{placeholders}` are left visible so registry data bugs are diagnosable.

`data` conditional: included only when there's no URL (canonical Worker contract).

Conformance progression

Before	After
3 / 10 pass	7 / 10 pass

Newly passing:

• `resolve-cve-2021-44228` (implicit `{id}` + no `data` field)
• `resolve-cwe-79` (explicit `{num}` via extract regex)
• `resolve-attck-t1059-003` (multiple explicit variables — `{parent}` and `{sub}`)
• `resolve-aiid-1` (implicit `{id}`)

Still failing (independent Phase 2.5 follow-up PRs):

• `resolve-cve-cross-source` — bare-namespace cross-source search
• `list-advisory-namespaces` — bare-type discovery
• `list-types` — `/api/v1/types` endpoint missing

Verification

```
$ pytest test_smoke.py -v
19/19 passed (13 prior + 6 new substitution unit tests)

$ python3 tests/conformance-harness/python/run.py --target http://localhost:8765
Results: 7 passed, 3 failed (out of 10)
```

New unit tests

• `test_substitute_template_no_placeholders` — fast-path
• `test_substitute_implicit_id` — CVE case
• `test_substitute_explicit_variable` — CWE case
• `test_substitute_multiple_variables` — ATT&CK sub-technique
• `test_substitute_implicit_id_with_explicit_others` — layered modes
• `test_substitute_unrecognized_placeholder_left_visible` — diagnostic-friendly fallback

🤖 Generated with Claude Code