feat: add security advisories support

[leoafarias]

Summary

Implements the /api/packages/<package>/advisories endpoint from the Hosted Pub Repository Specification Version 2. This endpoint is live and working on pub.dev, providing security advisories in OSV format for packages.

Changes

• Add packageAdvisories endpoint to Endpoint class
• Create PackageAdvisories, SecurityAdvisory, and Affected models following OSV schema 1.6.0
• Add packageAdvisories() method to PubClient that gracefully handles unsupported endpoints (returns null on 404)
• Include pubDisplayUrl convenience getter for accessing advisory URLs from database_specific field
• Add comprehensive tests including integration tests with real API data

Implementation Details

Models

The implementation follows the OSV (Open Source Vulnerability) schema 1.6.0:

• PackageAdvisories: Contains list of advisories and optional advisoriesUpdated timestamp
• SecurityAdvisory: Full OSV fields including id, summary, details, affected versions, and database_specific
• Affected: Tracks affected versions

Error Handling

The client gracefully handles three scenarios:

1. Packages with advisories (e.g., http, dio)
2. Packages without advisories (e.g., flutter - empty array)
3. Servers that don't support the endpoint (404 → returns null)

Testing

• ✅ Endpoint URL generation test
• ✅ Integration test with http package (1 advisory)
• ✅ Integration test with dio package (2 advisories)
• ✅ Integration test with flutter package (no advisories)
• ✅ All 48 tests passing

Usage Example

final client = PubClient();
final advisories = await client.packageAdvisories('http');

if (advisories != null) {
  print('Last updated: ${advisories.advisoriesUpdated}');
  
  for (final advisory in advisories.advisories) {
    print('${advisory.id}: ${advisory.summary}');
    print('URL: ${advisory.pubDisplayUrl}');
  }
}

Closes #67