feat(metrics): record compression cache hits and misses

[coreydaley-cg]

Adds compression as a third cache on the existing apko_cache_accesses_total{cache,result} counter, so the diffID to descriptor cache's hit rate can be measured in a real deployment.

Context is #2485. That cache is the reason layer writes are two-pass — deferring compression requires a materialized plain tar to defer against — and whether the trade pays depends on how often the same diffID recurs inside one process. That has never been measured, and local approximation is not convincing for a heavily scaled service where the cache is per-process and builds are spread across many instances.

Notes

Nothing to do on the consumer side. Callers that already run metrics.Register(...) pick up the new label value with no change.

Only the first lookup per layer is recorded. compress() short-circuits once l.compressed != "", so the Digest() then Size() second lookup on the same layer costs nothing whether it hits or misses. Counting it would roughly double the apparent hit rate and overstate what the cache saves. A hit here means a layer genuinely avoided being compressed.

No bypass result. The compression cache is always consulted, so unlike the index and resolver caches there is no bypass path, and pre-initialising one would create a series that can never be non-zero.

Testing

TestCacheAccesses extended to cover the new cache. Full pkg/... suite passes.