Add npm health metrics orchestration pipeline

[Berserk-hub150]

Summary

Implements the ScanCode.io orchestration side of #2154 with a new npm_health pipeline.

• validates a versioned npm Project.purl
• retrieves exact npm registry metadata
• captures repository, tarball, and homepage collection targets
• derives baseline metadata health signals
• supports a shell-free external metrics adapter for GrimoireLab/other collectors
• normalizes 0..1 and percentage metrics
• computes weighted 0-100 scores and classifications
• caches results with configurable staleness
• persists reusable data in Project.extra_data["npm_health"]
• writes portable JSON output
• includes focused helper and pipeline regression tests
• documents the built-in pipeline and collector contract

The GrimoireLab-specific subtasks #2167 and #2168 are already assigned, so this PR provides the ScanCode.io integration contract without duplicating those implementations.

Validation

• exactly 70 Signed-off-by commits
• git diff --check passes
• all added Python modules/tests pass py_compile
• full repository lint/test coverage is left to project CI

Addresses #2154