Improve publishing guidelines for Open VSX

Open VSX currently allows extensions to be published without repository, homepage, or issue tracker links. When these fields are provided, they are not validated for correctness or reachability.

As a result:

- Some extensions include missing, invalid, or private repository links.
- Users are unable to report issues or verify the origin of an extension.
- Invalid links may reduce trust or signal low-quality or potentially malicious content.
- The Open VSX team receives recurring support emails about broken or missing links.

This is not a violation of our current terms, but expectations are unclear and not formally documented.

## Proposal

1. **Document clear publishing guidelines**
- Define which metadata fields are required, recommended, or optional.
- Clarify expectations when links are provided (e.g. must resolve, must be publicly accessible, etc.).
- Explicitly document that repositories may be private, if that remains acceptable.
- Update moderation practices on https://www.eclipse.org/legal/compliance/dsa/#open-vsx-registry as needed

2. **Introduce lightweight validation**
- Warn publishers if provided URLs are malformed or unreachable at publish time.
- Do not block publication initially.

3. **Use metadata as a quality signal**
- Consider downranking extensions with missing or invalid metadata.
- Surface metadata completeness in the admin dashboard.

Start by reviewing the Open VSX publishing flow and the linked DSA moderation guidance. Define the required, recommended, and optional metadata expectations, then trace where URL warnings, metadata quality signals, and admin-dashboard completeness could fit. Done should include documented expectations and lightweight, non-blocking handling for malformed or unreachable links.

Written by the indexing model from the issue text.