feat: Add support for MCP Bundles (MCPB) in registry (#295)

## Motivation and Context
- Add MCPB as a new registry_name option
- Add file_hashes field to package model for integrity verification
- Implement URL validation restricting MCPB packages to GitHub/GitLab
hosts
- Require SHA-256 hash for all MCPB packages
- Add example MCPB package in documentation
- Update schemas and OpenAPI specification

See issue #260

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

## Breaking Changes
N/A, registry has not yet been launched

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed

---------

Co-authored-by: Adam Jones <adamj+git@anthropic.com>

docs/server-registry-api/openapi.yaml

@@ -95,8 +95,9 @@ paths:
                     version_detail:
                       version: "1.0.2"
                     packages:
-                      - registry_name: "npm"
-                        name: "@modelcontextprotocol/server-filesystem"
+                      - registry_type: "npm"
+                        registry_base_url: "https://registry.npmjs.org"
+                        identifier: "@modelcontextprotocol/server-filesystem"
                         version: "1.0.2"
                   x-publisher:
                     tool: "publisher-cli"
@@ -117,8 +118,9 @@ paths:
                     version_detail:
                       version: "1.0.0"
                     packages:
-                      - registry_name: "npm"
-                        name: "@example/mcp-demo-server"
+                      - registry_type: "npm"
+                        registry_base_url: "https://registry.npmjs.org"
+                        identifier: "@example/mcp-demo-server"
                         version: "1.0.0"
                   x-publisher:
                     contact_email: "maintainer@example.com"
@@ -272,23 +274,41 @@ components:
 
     Package:
       type: object
-      required:
-        - registry_name
-        - name
-        - version
       properties:
-        registry_name:
+        registry_type:
           type: string
-          description: Package registry type
-          example: "npm"
-        name:
+          description: Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'docker-hub', 'nuget', 'mcpb')
+          examples:
+            - "npm"
+            - "pypi"
+            - "docker-hub"
+            - "nuget"
+            - "mcpb"
+        registry_base_url:
           type: string
-          description: Package name in the registry
-          example: "io.modelcontextprotocol/filesystem"
+          format: uri
+          description: Base URL of the package registry
+          examples:
+            - "https://registry.npmjs.org"
+            - "https://pypi.org"
+            - "https://docker.io"
+            - "https://api.nuget.org"
+            - "https://github.com"
+            - "https://gitlab.com"
+        identifier:
+          type: string
+          description: Package identifier - either a package name (for registries) or URL (for direct downloads)
+          examples:
+            - "@modelcontextprotocol/server-brave-search"
+            - "https://github.com/example/releases/download/v1.0.0/package.mcpb"
         version:
           type: string
           description: Package version
           example: "1.0.2"
+        file_sha256:
+          type: string
+          description: SHA-256 hash of the package file for integrity verification.
+          example: "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce"
         runtime_hint:
           type: string
           description: A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtime_arguments` are present.