HMS-11149: Fix rpm list support for partner repos

[johnelliott626]

Summary

Currently the endpoint for listing RPMs /repositories/{uuid}/rpms is broken for foreign-org viewers of partner repos. This PR fixes the endpoint for that use case with a couple clear distinctions when a foreign-org viewer (of a partner repo) accesses the endpoint vs. a repo owner:

1. RPMs are listed based on the latest published snapshot (instead of latest state in our DB)
2. RPMs are retrieved via the Pulp API (instead of direct DB access)
3. RPM UUIDs are omitted in the response

The endpoint behavior for a repo owner accessing the endpoint is unchanged.

Testing steps

Part 1: Set up a partner repo

1. Start the content-sources-backend server
2. Set up a partner repo: UPDATE repository_configurations SET partner = true WHERE uuid = '<uuid>'; (must be an upload repo owned by an org your local environment has access to)
3. Publish a snapshot: UPDATE snapshots SET published = true WHERE uuid = '<snap_uuid>';
4. Sync public flag: UPDATE repositories SET public = true WHERE uuid = (SELECT repository_uuid FROM repository_configurations WHERE uuid = '<repo_config_uuid>');

Part 2: Call the endpoint

1. Call the repo rpm endpoint as a user from the owner org:
2. Call the repo from a foreign org and the similar results should be returned (rpm uuid will be omitted)

curl --location 'http://localhost:8000/api/content-sources/v1.0/repositories/YOUR_REPO_ID/rpms' \
--header "$(./scripts/header.sh <YOUR_ORG_ID>)"

GIF describing this PR 😆

[xbhouse]

https://issues.redhat.com/browse/HMS-11149

[johnelliott626]

/retest

[red-hat-konflux]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

[rverdile]

I don't think I've ever seen snyk find a real issue

[swadeley]

/retest-playwright