feat: Add support for MCP Bundles (MCPB) in registry (#295)

## Motivation and Context
- Add MCPB as a new registry_name option
- Add file_hashes field to package model for integrity verification
- Implement URL validation restricting MCPB packages to GitHub/GitLab
hosts
- Require SHA-256 hash for all MCPB packages
- Add example MCPB package in documentation
- Update schemas and OpenAPI specification

See issue #260

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

## Breaking Changes
N/A, registry has not yet been launched

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed

---------

Co-authored-by: Adam Jones <adamj+git@anthropic.com>

internal/service/registry_service.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/url"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -68,6 +70,61 @@ func (s *registryServiceImpl) GetByID(id string) (*model.ServerResponse, error)
 	return &response, nil
 }
 
+// validateMCPBPackage validates MCPB packages
+func validateMCPBPackage(host string) error {
+	allowedHosts := []string{
+		"github.com",
+		"www.github.com",
+		"gitlab.com",
+		"www.gitlab.com",
+	}
+
+	isAllowed := false
+	for _, allowed := range allowedHosts {
+		if host == allowed {
+			isAllowed = true
+			break
+		}
+	}
+
+	if !isAllowed {
+		return fmt.Errorf("MCPB packages must be hosted on allowlisted providers (GitHub or GitLab). Host '%s' is not allowed", host)
+	}
+	
+	return nil
+}
+
+// validatePackage validates packages to ensure they meet requirements
+func validatePackage(pkg *model.Package) error {
+	registryType := strings.ToLower(pkg.RegistryType)
+	
+	// For direct download packages (mcpb or direct URLs)
+	if registryType == "mcpb" || 
+	   strings.HasPrefix(pkg.Identifier, "http://") || strings.HasPrefix(pkg.Identifier, "https://") {
+		parsedURL, err := url.Parse(pkg.Identifier)
+		if err != nil {
+			return fmt.Errorf("invalid package URL: %w", err)
+		}
+		
+		host := strings.ToLower(parsedURL.Host)
+		
+		// For MCPB packages, validate they're from allowed hosts
+		if registryType == "mcpb" || strings.HasSuffix(strings.ToLower(pkg.Identifier), ".mcpb") {
+			return validateMCPBPackage(host)
+		}
+		
+		// For other URL-based packages, just ensure it's valid
+		if parsedURL.Scheme == "" || parsedURL.Host == "" {
+			return fmt.Errorf("package URL must be a valid absolute URL")
+		}
+		return nil
+	}
+	
+	// For registry-based packages, no special validation needed
+	// Registry types like "npm", "pypi", "docker-hub", "nuget" are all valid
+	return nil
+}
+
 // Publish publishes a server with separated extensions
 func (s *registryServiceImpl) Publish(req model.PublishRequest) (*model.ServerResponse, error) {
 	// Create a timeout context for the database operation
@@ -84,6 +141,13 @@ func (s *registryServiceImpl) Publish(req model.PublishRequest) (*model.ServerRe
 		return nil, err
 	}
 
+	// Validate all packages
+	for _, pkg := range req.Server.Packages {
+		if err := validatePackage(&pkg); err != nil {
+			return nil, fmt.Errorf("validation failed: %w", err)
+		}
+	}
+
 	// Validate reverse-DNS namespace matching for remote URLs
 	if err := model.ValidateRemoteNamespaceMatch(req.Server); err != nil {
 		return nil, err