feat: manage plugin blacklist via dedicated endpoints

[mmatur]

What does this PR do?

Adds dedicated blacklist endpoints to plugin-service, backed by a new MongoDB collection, so the list of repositories excluded from the Piceus scraping lives in the database instead of a hardcoded map in Piceus. Introduces db.BlacklistEntry (repository = owner/repo unique key, plus reason, author, createdAt), a MongoDB store with ListBlacklist, an idempotent UpsertBlacklist (createdAt set only on insert) and DeleteBlacklist, and a unique index on repository. Exposes GET /internal/blacklist, POST /internal/blacklist (upsert, with owner/repo validation) and DELETE /internal/blacklist/{owner}/{repo} (idempotent, always 204), registered as method-aware routes on the stdlib ServeMux because the static blacklist segment conflicts with the /:uuid wildcard of the internal httprouter.

Motivation

Piceus regularly hits repositories it must skip (crashers, repos that don't allow issues, non-plugins). Today that list is hardcoded in scrapper.go, so every change means editing code and redeploying. Moving it behind plugin-service lets it be managed at runtime — Piceus reads it, hub-admin edits it. Part of traefik/infra#11170.

More

• Added/updated tests
• Added/updated documentation

Additional Notes

Consumed by Piceus (GET /internal/blacklist) and by the hub-admin management UI, in separate PRs. Deploy this one first.