Expose authenticated GET /api/packages/<package>/publishing endpoint for configuration introspection #9559

Context & Problem

Currently, pub.dev only exposes PUT /api/packages/<package>/publishing (gated behind web session cookies). There is no programmatic GET endpoint to retrieve a package's publishing configuration.

This prevents:

1. GitHub Actions & CI Pipelines: Automated workflows cannot verify whether their repository, environment, and tag patterns match the registered package configuration before attempting release or publish steps.
2. Developer & Agent Tooling: CLI tools and AI coding assistants cannot inspect automated publishing settings, manual publishing locks, or GCP service account associations using stored credentials.

Proposed Solution

Add an authenticated GET /api/packages/<package>/publishing endpoint in pubapi.dart returning the PkgPublishingConfig payload.

Authorization Matrix

The endpoint requires a valid Bearer token (requireAuthenticatedClient()):

Note: For GitHub Actions OIDC introspection, only the repository identity is validated; tag pattern and environment constraints are only enforced during pub publish.

Acceptance Criteria

• Add GET /api/packages/<package>/publishing route in pubapi.dart and pubapi.client.dart.
• Implement packageBackend.getPackagePublishing(String package) with authorization checks for User admins, GitHub Actions OIDC tokens, and GCP Service Accounts.
• Return PkgPublishingConfig (GitHub config, GCP config, and manual publishing restriction status).
• Add unit and integration tests covering anonymous, non-admin, admin, matching GitHub Action OIDC, and mismatched GitHub Action OIDC callers.

Related Issues

• Related to Allow disabling publication of a package from cli when automated publishing is enabled #8992 (provides read API for isManualPublishingDisabled)
• Related to Pub.dev does not show OIDC details of a package in API #9352 (authenticated OIDC config inspection)
• Client-side CLI tracking issue: Add dart pub admin show command to inspect package publishing configuration pub#4893