XRAY-140550 - Onboarding uv for jf curation-audit

[Phavya-jfrog]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

Onboards uv as a supported package manager for jf curation-audit, plus support for auditing standalone PEP 723 inline scripts. Registry details are read from pyproject.toml's [[tool.uv.index]] or ~/.config/uv/uv.toml (however Artifactory's "Set Me Up" configures it) — no jf uv-config step needed. Resolution always goes through Artifactory's curation pass-through endpoint: uv.lock is regenerated in a temp dir unless it's both up-to-date and verified as already resolved from Artifactory, in which case it's reused as-is.

New --script flag audits a single PEP 723 inline script directly instead of scanning the working directory. When a uv project has an un-audited sibling script, jf ca surfaces a one-line hint to use --script.

Changes

• Add techutils.Uv to curation-audit's supported technologies, with a minimum-version gate (uv >= 0.6.17).
• Add GetNativeUvRegistryConfig/setRepoFromUvToml for registry detection, and generateUvLockInTempDir/generateUvLock to resolve uv.lock through the curation pass-through endpoint.
• Add parseUvLock, buildUvDepTree, and buildUvDownloadUrlsMap to build the dependency tree and download URLs from the lock file, including multi-version marker forks and workspace members.
• Add buildDependencyTreeForScript/generateUvScriptLockForCuration and the --script flag for auditing PEP 723 inline scripts standalone.
• Add WrapUvCurationErr/classifyUvCurationLockError so CVS-stripped versions route through the existing metadata-API fallback table instead of a bare error.
• Fix Poetry's CVS-fallback to recover range-constrained transitive dependencies via poetryDependsOnParentRegex (previously only exact pins were caught).
• Fix promotePipToUv so a pip-exclusive file (requirements.txt, Pipfile, etc.) always wins over a stray uv.lock, and vice versa.

---

[gineshkumar]

Could you add a description covering the uv project and PEP 723 script flows, registry/auth behavior, validation performed, and the Poetry CVS fallback changes? The current body is only the unchecked template, so reviewers cannot verify the intended scope or design trade-offs.

---

Review generated by xray-pr-review