Add exclude newer flag

[efficks]

Adds a PROXPI_EXCLUDE_NEWER setting (seconds) that holds back recently-uploaded files from being served. Basically a quarantine window, for anyone who wants a buffer against brand-new releases before trusting them. PROXPI_EXCLUDE_NEWER_UNKNOWN controls what happens to files with no known upload time, defaults to excluding them. That matters more for the HTML API though, since it never reports upload times at all, so everything served through it counts as "unknown" right now.

Also stopped passing through upstream's versions list as-is once files for a project get filtered out. You could end up with a version listed that had zero files left after exclusion, and that'd throw off resolvers that use the field as a shortcut.

Added tests for the exclusion logic, unit plus a couple through the mock index. README's got the new env vars documented too.

Issue: #110

[EpicWink]

Your implementation drops the excluded packages on read from the source index, instead of filtering them from the response to clients. This means the cache will provide stale responses

[efficks]

Pushed a fix: moved the exclusion filtering out of _list_files (baked into the cache at fetch time) into Cache.list_files, which runs fresh on every request.

The per-index cache now always stores the full, unfiltered file list, and the exclusion window gets evaluated against the current time on each call, so a file becomes visible again the moment it ages out of the window instead of waiting for the next cache refresh.

[efficks]

@EpicWink May I propose you to use pydantic_settings to load your config from environment variable? I'm using them in my projects. I can do an other PR with the implementation if you like. a new class for all config with validation of use input through pydantic-setting.

[EpicWink]

May I propose you to use pydantic_settings to load your config from environment variable?

I'm considering dropping FastAPI (and therefore pydantic) in favour of Starlette (see #115)