swarm-controller: read review rules at a literal nested path

forgejo-api escapes the whole file path of a raw-file request, so the
rules file went out as `raw/.hyperhive%2Freview-classifier.yml` and
reached the forge only if every proxy and router in between decoded the
`%2F`. The controller now sends that one request itself: `raw_file_url`
escapes each path segment on its own and joins them with `/`, and
`forge::Client` holds a second HTTP client with the same token for it.

A 404 from the default-branch lookup now means "no commit on the
default branch", like an empty repo, instead of falling through to the
route's "no repo" answer. Only the repo lookup's 404 still means the
repo doesn't exist.

Tests cover the URL shape, the reads against a loopback stub forge
that serves only the literal path, the branch 404, 503 with no forge
access, 503 at the forge deadline on a paused clock, and a bad
polarity value.

Part of #5096.

swarm-controller/src/forge/docs_grant.rs

@@ -206,7 +206,6 @@ mod tests {
 
     use axum::extract::{Path, State};
     use axum::http::{StatusCode, header::CONTENT_TYPE};
-    use forgejo_api::{Auth, Forgejo};
 
     use super::*;
 
@@ -255,8 +254,7 @@ mod tests {
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
         let url = url::Url::parse(&format!("http://{}/", listener.local_addr().unwrap())).unwrap();
         tokio::spawn(async move { axum::serve(listener, app).await });
-        let api = Forgejo::new(Auth::Token("stub-token"), url.clone()).unwrap();
-        (Client { api, url }, docs)
+        (Client::with_token("stub-token", url).unwrap(), docs)
     }
 
     async fn check(