fix(har): support UPSTREAM registry creation, --level scoping in firewall_scan, and NuGet lockfiles

[BlueLabelscotch]

Summary

Fixes three Artifact Registry defects found during CLI testing:

• create registry --type UPSTREAM had no way to supply auth/source config.
  Added --source, --url, --auth-type, --username, --secret-identifier,
  --access-key, --secret-key-identifier, --remote-url-suffix, and
  --firewall-mode flags, wired into the existing config.* body_params via
  dot-path nesting (same declarative mechanism already used for config.type).

• execute registry:firewall_scan --level account|org was silently ignored.
  firewall_scan is a workflow-handler command, so it never went through
  callEndpointFull (the only place --level was previously applied). Added an
  applyLevelScope helper that mirrors that scope-stripping logic and wired it
  into both firewall_scan handlers. Also fixed a related bug found while
  verifying this live: getRegistryUUID's raw HTTP call was missing the
  accountIdentifier query param that the generic client injects automatically
  for all other endpoint-routed requests, which made account-level lookups 404
  even after the scope fix.

• execute registry:firewall_scan --lockfile packages.lock.json (NuGet)
  was rejected as an unsupported file format. Added a case to parseLockFile
  that reuses the existing nugetParseLockFile parser (already used by the
  dotnet restore auto-flow), so no new parsing logic was needed.