feat(registry): hosted semver static redirect

[ricardo-devis-agullo]

Consumers of a component's bundled static files currently have to know the CDN base URL and the exact version, because oc only registers a static route when running locally.

This adds a hosted-mode route mirroring the local one:

GET /:componentName/:componentVersion/static/*splat -> 302 to CDN file

• Resolves the version with the same version-handler used for rendering (semver.maxSatisfying over repository.getComponentVersions, i.e. the cached components list, so no self-request and works with metadata adapters).
• Redirect target is built with repository.getStaticFilePath, so it follows the existing storageOptions CDN on/off toggle.
• Redirect (not proxy): registry serves no extra bytes, CDN caching preserved.
• 404 on unknown component, unsatisfiable range, empty/traversal paths, and private files (server.js, dotfiles via isPrivateComponentFile).
• Purely additive: hosted-only route registered before the generic component routes; local mode unchanged.

Example:
GET /my-component/2.x.x/static/public/scripts/workerScripts.cjs.js
-> 302 https:///components/my-component/2.0.167/public/scripts/workerScripts.cjs.js

Tests: test/unit/registry-routes-component-static.js (34 cases: exact, range, 404s, private-file block, traversal, router registration incl. prefix).