swarm-controller: read review rules at a literal nested path

forgejo-api escapes the whole file path of a raw-file request, so the
rules file went out as `raw/.hyperhive%2Freview-classifier.yml` and
reached the forge only if every proxy and router in between decoded the
`%2F`. The controller now sends that one request itself: `raw_file_url`
escapes each path segment on its own and joins them with `/`, and
`forge::Client` holds a second HTTP client with the same token for it.

A 404 from the default-branch lookup now means "no commit on the
default branch", like an empty repo, instead of falling through to the
route's "no repo" answer. Only the repo lookup's 404 still means the
repo doesn't exist.

Tests cover the URL shape, the reads against a loopback stub forge
that serves only the literal path, the branch 404, 503 with no forge
access, 503 at the forge deadline on a paused clock, and a bad
polarity value.

Part of #5096.

docs/swarm/review-classifier.md

@@ -257,8 +257,9 @@ ones. The route answers:
   `commit` (the commit the route read the file at) and `classifications`, in
   the file's order and in the POST's shape
 - **400** for a `repo` that's missing or not `owner/name`
-- **404** for a repo the forge doesn't know, a repo with no commit, or a
-  default branch with neither file
+- **404** for a repo the forge doesn't know; a default branch with no commit,
+  in an empty repo or when the default branch doesn't exist; or a default
+  branch with neither file
 - **422** for both files on the default branch, or a file that doesn't parse
   or breaks a rule from [Repo configuration](#repo-configuration); the
   `detail` names the file and what's wrong