Request: add an option to set the Hackage upload API URL

**Describe the bug**

Currently, `cabal-install` seems to use the `url` field as the API endpoint. If the user is using a mirror of Hackage, then she won't be able to upload to Hackage. Hence, it would be great if Cabal supports an additional option that sets the upload API endpoint, e.g.

```
repository mirrors.ustc.edu.cn
url: https://mirrors.ustc.edu.cn/hackage/
secure: False
upload-api: https://hackage.haskell.org/
```

**To Reproduce**

Replace the `Hackage.haskell.org` repository with a mirror site:

```
repository mirrors.ustc.edu.cn
url: https://mirrors.ustc.edu.cn/hackage/
secure: False
```

Then do `cabal upload`. It now prompts for " username" and " password". Of course, it won't work even if I give my username and password.

**Expected behavior**

When `upload-api` is set, cabal now upload to `upload-api` instead of `url`.

I'm not familiar with Cabal and Hackage, so this could be a bad design. I'm okay with anything that fixes the problem, e.g. a catch-all `api` field to override any API calls.

**System information**
- `cabal`: 3.6.2.0

Start by tracing how repository `url` and `secure` fields are parsed and how `cabal upload` chooses its endpoint. Check the proposed `upload-api` behavior against the mirror example, then add coverage showing uploads use it while downloads still use `url`; done means the option works and is documented.

Written by the indexing model from the issue text.