Harden RemotePEP503Backend PEP 503 HTML link parsing #1279

Summary

Harden RemotePEP503Backend PEP 503 project-page parsing by extracting artifact URLs from HTML anchor href attributes, rather than relying solely on the current regex parser and anchor text.

Rationale

The current implementation intentionally covers the common simple-index shapes targeted by the unified cache manager. It may not handle multiline anchor elements or pages where the anchor text does not match the artifact basename. An HTMLParser-based approach should make parsing robust while preserving the existing cache lookup and integrity behavior.

Affected area

• src/fromager/cache.py
• RemotePEP503Backend project-page parsing helpers

Required changes

• Parse PEP 503 anchor elements with an HTML parser and use each anchor's href as the artifact source.
• Derive and validate the artifact filename from the URL path/basename rather than trusting anchor text.
• Preserve existing URL safety checks, SHA256 fragment handling, and insecure-HTTP policy.
• Add focused tests for multiline anchors and mismatched anchor text.

Acceptance criteria

• Valid wheel links are discovered when anchor tags span multiple lines.
• A valid wheel link is discovered when visible anchor text differs from the wheel filename.
• Unsafe filenames/URLs and insecure HTTP behavior remain rejected or allowed according to the existing policy.
• Existing PEP 503 parsing coverage remains passing.

Backlinks

• Unified cache manager PR: Add unified CacheManager with prioritized multi-backend lookup #1216
• Deferral discussion: Add unified CacheManager with prioritized multi-backend lookup #1216 (comment)

Requested by: @Xaenalt