XRAY-145929 - Onboard hugging face for jf curation-audit

[gauriy-tech]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

Adds huggingfaceml as a first-class package type in jf curation-audit, enabling curation policy enforcement for Hugging Face models used in Python and notebook projects.

Auto-discovery: When HF_ENDPOINT is set and .py/.ipynb files are present, jf ca statically scans source for HF call sites and probes each discovered model against Artifactory curation. Dynamic references and local paths are surfaced as warnings after the table.

Spot-check mode: --hugging-face-model=<org/model>[:] audits only the explicitly named models, skipping auto-discovery and all other package managers. Supports comma-separated values.

Datasets are detected but not audited — Catalog does not currently score datasets.

No impact on jf audit, jf scan, or any existing package manager workflow.

[gineshkumar]

[Re: commands/curation/curationaudit.go:934] Reusing getHuggingFaceNameAndVersion to extract the project label from the tree root (a directory name, not a repo_id:revision) makes every HF audit's project name show a spurious :main suffix in both the table title and the JSON summary Target field — SplitRepoIDAndRevision finds no : in a bare dir name and the revision unconditionally defaults to main. (Source: getUrlNameAndVersionByTech dispatch, line 2010)

	_, projectName, projectScope, projectVersion := getUrlNameAndVersionByTech(tech, rootNode, nil, "", "")
	if tech == techutils.HuggingFaceML {
		// rootNode.Id is a directory/project name, not a "repo_id:revision" model
		// reference — getHuggingFaceNameAndVersion's revision-defaulting logic only
		// applies to real model nodes.
		projectName, projectVersion = rootNode.Id, ""
	}

---

Review generated by xray-pr-review

[github-actions]

---

🐸 JFrog Frogbot