Cooldown is not applied to artifact downloads for Cargo, RubyGems, Hex, Conda, Pub and cached Helm charts #521

Cargo, RubyGems, Hex, Conda and Pub apply cooldown only to metadata (for example cargo.go applyCooldownFiltering, pub.go shouldFilterVersion). A client that requests the artifact URL directly gets a version that is still inside the cooldown window. Helm filters charts when it resolves the download URL, but handleChart serves a cached chart without checking (helm.go, the GetCachedArtifact hit). This is the same gap that #239 fixed for npm and PyPI, and #469 fixed for Composer.

Each of these download handlers should check cooldown before serving, whether the artifact is cached or not. The publication time comes from the database when stored, otherwise from a metadata lookup that then persists the time, as npm does.

Tests should go through each public artifact endpoint, with an artifact cached before the policy is raised, and check the download is withheld.

Split out from #338.