feat(papermc): migrate Paper source to v3 Fill API

[maldis018]

Migrate PaperMC source from the deprecated v2 API to the v3 Fill API

Closes #146

Problem

src/sources/papermc.rs resolves Paper builds through https://api.papermc.io/v2. PaperMC has frozen v2: its version list tops out at 1.21.11, and GET v2/projects/paper/versions/26.1.2/builds returns 404 {"error":"Version not found."}. Every modern Minecraft version (the 26.x scheme onward) lives only on the new Fill API at https://fill.papermc.io/v3, so mcman build cannot resolve a Paper jar for any current MC version. Full evidence in #146.

Change

Rewrites src/sources/papermc.rs to target the v3 Fill API. The v3 response shapes differ from v2, so the structs and resolve_source are reworked, not just the base URL:

• Base URL api.papermc.io/v2 → fill.papermc.io/v3.
• Builds are returned as a bare, newest-first JSON array (v2 wrapped them in an object, oldest-first). "latest" is now the first element; a pinned build hits the single-build endpoint /builds/{id} directly.
• Build id moved from build (u64) to id (u64).
• Server jar is keyed server:default in downloads (was application).
• Download URL is provided directly as downloads["server:default"].url, so it's used verbatim instead of being hand-constructed from the API path.
• Versions is now an ordered (newest-first) map of version-group → versions, deserialized into an IndexMap to preserve API order so "latest" is reliable. (Adds the serde feature to the existing indexmap dependency.)
• ResolvedFile now carries size and the sha256 from the v3 downloads[...].checksums.sha256 (v2 left both empty).
• Drops v2-only fields that v3 does not provide and the resolver never used: the PaperChannel enum, version_groups, promoted, and changes/commits. channel is retained as a plain String for forward-compat but is not used for filtering.
• Adds a validate_segment() allowlist on the user-supplied project / version / build values before they are interpolated into request URLs.

Testing

• cargo check passes.
• cargo clippy --all-features produces no findings in papermc.rs. (The repo currently has pre-existing clippy errors on main in unrelated files - init/mod.rs, packwiz.rs, jenkins.rs. This PR doesn't touch those.)
• End-to-end: mcman build against mc_version = "26.1.2" resolves the Paper jar and assembles a full 20-plugin server with correct loader-filtering. Verified in production on a live 26.1.2 server for several weeks.

Notes for the reviewer

• Clean cutover, no v2 fallback. The Fill API serves the full historical version list, so legacy MC versions (≤ 1.21.11) resolve through v3 as well. Happy to add a v2 fallback path instead if you'd prefer to keep the old endpoint for older servers.
• Single commit, based on current main (2665efb).

[deniz-blue]

LGTM, thanks for contributing