[Infra] Missing PEP 700 upload-time metadata breaks supply-chain security tools (uv, pip)

### Description
The official PyTorch package index (`download.pytorch.org`) currently does not expose the `upload-time` metadata in its package JSON API. While PEP 700 defines this field as technically optional (to support legacy servers), omitting it breaks compatibility with modern package management.

### Impact
Because this metadata is missing, modern Python package managers like `uv`, `pip`, and `pdm` cannot verify the age of the PyTorch packages. Features like `uv`'s `--exclude-newer` are critical for mitigating supply chain attacks (e.g., dependency confusion) by enforcing a "cooldown" period on newly published packages.

Currently, running a secure dependency resolution with a date cutoff fails entirely for PyTorch. I am forced to allow-list `torch` to bypass these security checks (e.g., using `--exclude-newer-package torch`). We currently live in the age of supply chain attacks, and many recent attacks across the industry could have been mitigated simply by avoiding running code published at `HEAD`.

### Steps to Reproduce
1. Create a minimal `pyproject.toml` depending on `torch`.
2. Map the package to the custom index: `https://download.pytorch.org/whl/cpu`
3. Run `uv lock --exclude-newer "2 weeks"`
4. The resolution fails, outputting warnings for every wheel:
`warning: torch-.whl is missing an upload date`

### Expected Behavior
The `download.pytorch.org` registry infrastructure should be updated to populate the `upload-time` field for all published wheels as defined in the PEP 700 JSON API. Providing this timestamp will ensure compatibility with modern Python security tooling.