feat(datasource/jsdelivr): add new jsdelivr datasource

[rm-code]

Changes

This PR adds a new datasource for the jsdelvir cdn as discussed in #26936, which is a blocker for #26937 and also could be used for a later libman manager implementation (see #41893).

The datasource queries the jsdelivr api: https://data.jsdelivr.com/v1

For fetching releases it queries three different endpoints for:

• scoped npm packages
• unscoped npm packages
• gh packages

To distinguish between gh and npm packages, it expects the manager to prefix the package name with a the respective type. As far as I understood, this should be the responsibility of the caller (extracting the URL from whatever source it's dealing with). Strictly speaking this goes against the outline given in the datasource/README.md:

• packageName: the package's full name including scope if present (e.g. @foo/bar)

If this is a violation against the coding guidelines, I would need some guidance to how we'd deal with the different endpoint types instead and I'll happily update the PR.

For digest it fetches a flat file structure via the respective API endpoints and searches for the asset in the list of files. I haven't found a better way of dealing with this, because the API doesn't offer any alternative afaict.

Context

Please select one of the following:

• This closes an existing Issue, Closes: jsDelivr datasource #26936
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required (unless I missed it)

I added a readme.md documenting the type-prefix requirement for this datasource.

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository: n/a

[rm-code]

The force push from 9b3ce45 to ad2d669 was in order to get rid of a "Fixes #..." tag in the commit message.