RFE: Support Crate Ownership

[dralley]

Consider supporting Crate ownership like crates.io -- users would be able to publish or modify only crates which they have maintainership over.

This is more of a long-term plan and should probably be optional. The "if you can auth, you can push" mode ought to continue being supported.

---

Crate Ownership

Goal: Track who owns which crate names, and only allow owners to publish new versions or yank. Deferred — any authenticated user with distribution-level permission can publish any crate name for now.

a. CrateOwnership model

class CrateOwnership(BaseModel):
    distribution = models.ForeignKey(RustDistribution, on_delete=models.CASCADE)
    crate_name = models.CharField(max_length=255)
    user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)

    class Meta:
        unique_together = ("distribution", "crate_name", "user")

• Scoped per-distribution (different registries can have different owners for the same crate name)
• First publisher of a crate name automatically becomes owner
• Owners can add/remove other owners

b. Ownership endpoints

Implement the Cargo owner API:

• GET /api/v1/crates/{name}/owners — list owners
• PUT /api/v1/crates/{name}/owners — add owner (body: {"users": ["username"]})
• DELETE /api/v1/crates/{name}/owners — remove owner

c. Publish authorization check

In CargoPublishApiView.put():

1. If the crate name has no owners yet → allow (auto-assign publisher as owner)
2. If the crate name has owners → only allow if request.user is an owner

d. Yank authorization check

Only crate owners (or distribution admins) can yank/unyank.