GeezerVison

Denylist entries were compared as plain PURL strings, while handlers build PURLs from download URLs that spell packages differently. Some denied versions were still served:

• PyPI: . vs -/_ (wheel filenames always use _)
• NuGet: entries with capitals never matched the lowercased ids
• RubyGems: platform gems such as nokogiri-1.16.0-x86_64-linux.gem
• conda: the handler's channel/name never matched a plain entry, and qualifiers were rejected

Entries and checked PURLs now go through one comparison form in internal/denylist. Handlers, cache keys and DB rows are unchanged. A conda entry matches every channel unless it has a channel qualifier. The docs list how each ecosystem is matched and drop the claim that PyPI separators were already handled.

A second commit covers more spellings: Composer's leading v, OCI repositories written as a path (manifests are now checked by tag and digest too), Swift registry packages in either form and when streaming, Go versions with escaped uppercase letters, and gems with a dash followed by a digit in their name. Gems like devise-2fa were parsed with the wrong name and version, so their cached copies are fetched again once.