feat: load blacklist from plugin-service instead of hardcoded map

[mmatur]

What does this PR do?

Loads the blacklisted repositories from plugin-service (GET /internal/blacklist) at the start of each run instead of the hardcoded map. Adds BlacklistEntry and Client.ListBlacklist to internal/plugin, extends the pluginClient interface, removes the hardcoded blacklist map from NewScrapper, and makes Run load the blacklist first via loadBlacklist.

Motivation

The blacklist was hardcoded in scrapper.go, so excluding a new repository required a code change and a redeploy. Reading it from plugin-service lets it be managed at runtime. The load is fail-closed: if the fetch fails the run aborts, because some blacklisted repositories make Piceus panic — scraping with an empty blacklist is worse than not scraping at all. Part of traefik/infra#11170.

More

• Added/updated tests
• Added/updated documentation

Additional Notes

Deploy after the plugin-service endpoints exist and the entries are seeded, otherwise the fail-closed run has nothing to load. skipNewCall (module-level skip) is left unchanged.