RFE: Support Crate Ownership

Consider supporting Crate ownership like crates.io -- users would be able to publish or modify only crates which they have maintainership over.

This is more of a long-term plan and should probably be optional. The "if you can auth, you can push" mode ought to continue being supported.

Crate Ownership

Goal: Track who owns which crate names, and only allow owners to publish new versions or yank. Deferred — any authenticated user with distribution-level permission can publish any crate name for now.

a. CrateOwnership model

class CrateOwnership(BaseModel):
    distribution = models.ForeignKey(RustDistribution, on_delete=models.CASCADE)
    crate_name = models.CharField(max_length=255)
    user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)

    class Meta:
        unique_together = ("distribution", "crate_name", "user")

• Scoped per-distribution (different registries can have different owners for the same crate name)
• First publisher of a crate name automatically becomes owner
• Owners can add/remove other owners

b. Ownership endpoints

Implement the Cargo owner API:

• GET /api/v1/crates/{name}/owners — list owners
• PUT /api/v1/crates/{name}/owners — add owner (body: {"users": ["username"]})
• DELETE /api/v1/crates/{name}/owners — remove owner

c. Publish authorization check

In CargoPublishApiView.put():

1. If the crate name has no owners yet → allow (auto-assign publisher as owner)
2. If the crate name has owners → only allow if request.user is an owner

d. Yank authorization check

Only crate owners (or distribution admins) can yank/unyank.

Start with the proposed CrateOwnership model and CargoPublishApiView.put(), then review the three Cargo owner endpoints and the yank authorization path. Done means ownership is scoped per distribution, first publishers are assigned automatically, owners can manage owners, and publish/yank permissions follow the stated rules while unauthenticated ownership mode remains supported.