swarm-controller: read a repo's review rules from its default branch

`GET /api/review-classifier/rules?repo=owner/name` reads
`.hyperhive/review-classifier.yml` or `.json` from the repo's default
branch with the controller's forge token, on every request, and answers
the classifications in the try-out POST's shape, plus the file, the
branch and the commit it was read at. The swarm UI's try-out page loads
them into its editor (#5134).

The file is one `classifications` list of the try-out's `Classification`.
A missing file, both files, a parse error, any unknown key, an empty list
or more than ten entries is a problem+json error, never a pass. The
checks the POST makes on its classifications move into one function both
paths call.

The doc names the file and its schema, replacing the placeholders, and
documents the route.

Part of #5096.

swarm-controller/src/main.rs

@@ -3281,6 +3281,7 @@ fn build_app(state: AppState) -> axum::Router {
         .routes(routes!(issue_report::get_issue_report))
         .routes(routes!(review_classifier::post_try_out))
         .routes(routes!(review_classifier::get_try_out))
+        .routes(routes!(review_classifier::get_rules))
         .routes(routes!(webhook::post_webhook_forge))
         .split_for_parts();
     // Just the JSON, not the UI — Swagger UI itself is nginx-hosted from