feat: add namespace blocking functionality for JWT authentication (#313)

## Summary

Implements a denylist mechanism to prevent blocked namespaces from
publishing packages:

- Added `BlockedNamespaces` field to `JWTManager` struct for maintaining
the denylist
- Added validation logic in `GenerateTokenResponse` that checks user
permissions against blocked namespaces
- Admins with global permissions (`*`) bypass the blocking logic
- Added comprehensive test coverage for all blocking scenarios

Fixes #98

internal/auth/blocks.go

@@ -0,0 +1,9 @@
+package auth
+
+// BlockedNamespaces contains a list of namespaces that are not allowed to publish packages.
+// This is used as a denylist mechanism to prevent abuse.
+var BlockedNamespaces = []string{
+	// Add blocked namespaces here, e.g.:
+	// "io.github.spammer",
+	// "com.evil-domain",
+}