apt proxies: a pool path whose package cannot be named bypasses the reader's package selector #799

Problem

pool_package (crates/formats/apt/src/layout.rs:155-163) returns None when the file name is no <name>_<version>_<arch>.deb and the directory is no valid package name. locate_kept then applies no selector at all, as for a signed index ("a file of no package is every reader's", crates/formats/apt/src/lib.rs:167-172, crates/server/src/files/mod.rs:208-213).

Request segments may contain ; (validate_segment, crates/plugin-api/src/files.rs:67-87). upstream_url (crates/formats/apt/src/proxy.rs:30-43) pushes segments with path_segments_mut, which leaves ; as it is. A pool file is fetched with no index check (proxy.rs:56-57).

Scenario

1. An apt proxy of a Nexus (Jetty) or Artifactory (Tomcat) repository. A reader's grant on it has a selector internal-*.
2. The reader GETs pool/main/o/openssh;x/openssh-server_9.2p1-2+deb12u3_amd64.deb;x.
3. The file name ends in ;x, and openssh;x is no package name, so no selector check runs.
4. Jetty and Tomcat drop ;x as path parameters and serve openssh-server. Forge caches it under that path and serves it to the reader, whose selector does not allow openssh-server.

Expected

For a caller whose selector is not allow-all, a pool path whose package cannot be determined answers 404. Optionally refuse ; in apt pool paths altogether, since Debian file names never contain it. Test in crates/server/tests/apt.rs with a selector-scoped reader.

New with #176 (#725). Found in the 2.2.0 release review.