feat: add PyPI package configuration device policy

[raysubham]

What does this PR do?

Adds package_config/pypi Device Policy support for pip and uv.

• Reconciles pip, uv, and netrc configuration for the resolved user, with independent client outcomes and aggregate compliance reporting.
• Stores the Python credential only in netrc and protects managed files with confined path traversal, symlink checks, atomic replacement, bounded backups, ownership validation, rollback, POSIX modes, and Windows ACLs.
• Supports DMG enforcement and component-scoped MDM verify-only observation without transmitting credentials.
• Preserves existing npm filesystem and configuration-audit behavior.

Type of change

• Bug fix
• Enhancement
• Documentation

Testing

• Tested on macOS (version: 26.5.2)
• Binary and CLI smoke tests pass: make smoke
• JSON output is validated by the smoke suite
• No secrets or credentials included
• Lint passes: make lint
• Race tests pass with enterprise environment overrides unset: env -u DMG_CUSTOMER_ID -u DMG_API_ENDPOINT -u DMG_API_KEY make test

Additional verification:

• go vet ./...
• Linux/amd64, Darwin/arm64, and Windows/amd64 cross-vet and cross-build with CGO_ENABLED=0
• go mod tidy with no go.mod or go.sum drift
• gosec -quiet -include=G101,G304 ./internal/devicepolicy/... ./internal/secureuserfile/...
• gofmt and git diff --check

Related Issues

N/A