feat: Remove exclude_newer from rattler_lock, add package_cutoffs

[pavelzw]

Description

required for prefix-dev/pixi#5786

i think a configuration as follows would be easiest to understand in pixi.toml:

[workspace]
channels = [
  { url = "https://my.private/channel", exclude-newer = "0d" },
  "https://prefix.dev/conda-forge",
]
exclude-newer = "7d"

[dependencies]
polars = { version = "*", exclude-newer = "0d" } # some vulnerability

[constraints]
openssl = { exclude-newer = "0d" } # some vulnerability of an implicit dependency

i.e. a three-layer system, global exclude-newer < channel-wide exclude-newer < package-override exclude-newer. this allows us to use only the notion exclude-newer across different context instead of introducing something like exclude-newer = false.

How Has This Been Tested?

unit tests

AI Disclosure

• This PR contains AI-generated content.
  • I have tested any AI-generated content in my PR.
  • I take responsibility for any AI-generated content in my PR.

Tools: Codex

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added sufficient tests to cover my changes.