feat: add plain-HTTP listeners for various repository configurations to support non-HTTPS access

Signed-off-by: d9pouces <github@19pouces.net>

README.md

@@ -23,6 +23,14 @@ deployed to the target device.
   `--config-url-insecure` disables certificate (and hostname) verification entirely instead, overriding
   `--config-url-cacert-content` - **insecure**, only meant for a first bootstrap against a server whose
   certificate isn't trustable, or trusted, yet by any other means.
+- `--user` (repeatable) names a user to also prepare *per-user* configuration for, on top of the usual
+  system-wide files, for the modules that have one: `go`, `nuget`, `php` (Composer), `python` (poetry) and
+  `rust`. The user's home directory is taken from `--src`'s own `/etc/passwd` entry when there is one,
+  otherwise assumed to be `/home/<user>` (`/root` for `root`).
+- `--auto-users` does the same for every *regular* (non-system) user found in `--src`'s `/etc/passwd`: one with
+  a login shell (not `nologin`, `sync` or `false`) and a UID at or above `UID_MIN` (read from `--src`'s
+  `/etc/login.defs`, 1000 by default) - except `root`, always included regardless of its UID. It combines
+  freely with one or more `--user`.
 - On `apply`, every module inspects the configuration and the source filesystem and decides for itself whether it has something to
   do; only relevant modules touch the destination directory. For example, the configured Alpine repositories are only written if
   `--src` can be identified as an Alpine filesystem (i.e. it has an `/etc/apk` directory); and a source cloning Debian's official
@@ -95,6 +103,12 @@ id-configurator apply \
   --config-url-cacert-content "$(cat internal-ca.pem)" \
   --dst ./output
 
+# Also prepare per-user configuration (go, nuget, php, python, rust) for specific users
+id-configurator apply --config config.yaml --dst ./output --user alice --user bob
+
+# Same, but auto-detect every regular (non-system) user from --src's /etc/passwd
+id-configurator apply --config config.yaml --src /path/to/rootfs --dst ./output --auto-users
+
 # Validate a configuration without applying it
 id-configurator validate --config config.yaml
 
@@ -145,6 +159,7 @@ configurations:
       - name: <string>
         url: <string>
         key: <RSA public key, optional>
+        key_filename: <string, optional>                 # name of the key file under /etc/apk/keys/, if not the derived default
         url_to_replace: <fnmatch pattern, optional>
   yum:
     repositories:
@@ -175,6 +190,7 @@ configurations:
     repositories:
       - name: <string>
         url: <string>
+        is_sparse: <bool, optional, default false>       # declares the registry's index as sparse+<url>
   go:
     repositories:
       - name: <string>
@@ -200,6 +216,22 @@ replaces Debian's default mirror if (and only if) it's actually there, without d
 given machine might already have. Leaving the field unset never disables anything - the configured repository
 is simply added alongside whatever is already present.
 
+### Non-HTTPS repositories
+
+A repository URL doesn't have to be HTTPS - several modules automatically adjust the tool's configuration so
+the plain-HTTP repository is actually usable, instead of silently producing a config the package manager
+would refuse at run time:
+
+- `python`: pip gets the repository's host added to `trusted-host`.
+- `php`: Composer gets `secure-http` disabled, and `packagist.org` is disabled alongside it (an HTTP source
+  implies a private, non-internet setup where the public registry wouldn't be reachable anyway).
+- `nuget`: the source gets `allowInsecureConnections="true"`.
+- `java`: SBT's resolver gets `allowInsecureProtocol` appended. **Leiningen is the one exception**: its
+  standalone launcher refuses any non-HTTPS repository unconditionally, with no configuration able to change
+  that - a repository configured here simply won't be usable from Leiningen specifically.
+- `go`, `rust`, `apt`, `apk`, `yum`: no adjustment is needed - these already work the same regardless of
+  scheme.
+
 ## Modules
 
 | Module         | Applies to                                                                                                                                          |
@@ -217,6 +249,9 @@ is simply added alongside whatever is already present.
 | `ruby`         | Points RubyGems at the configured sources, replacing rubygems.org.                                                                                     |
 | `nuget`        | Points NuGet at the configured package sources, replacing nuget.org.                                                                                    |
 
+`go`, `nuget`, `php`, `python` and `rust` additionally honor `--user`/`--auto-users` (see "How it works" above),
+writing the same per-user configuration under each such user's home directory.
+
 This tool's own modular structure is meant to be extended: see `CLAUDE.md` for the module interface and how to add one.
 
 ## Development