Fix 500 in public#binary_packages for scmsync project packages

[Jarvis-J-Jacob]

What

GET /public/binary_packages/:project/:package returns HTTP 500
(undefined method 'project' for nil) when the requested package belongs
to a project that uses scmsync — e.g.
https://api.opensuse.org/public/binary_packages/openSUSE:Leap:16.0/eza.

Why

Packages of scmsync projects live in the project's git repository, not
in the database. #binary_packages guards access with
check_package_access(..., use_source: false), which calls
Package.get_by_project_and_name(..., use_source: false). For a package
of an scmsync project that method returns nil instead of raising
(it only follows the scmsync link when follow_project_scmsync_links: true), so the guard passes. @pkg is then nil and the action crashes
at @pkg.project.repositories.

This adds a fallback: when the DB lookup returns nil, build a read-only
Package from the backend package meta
(follow_project_scmsync_links: true), which provides the project, its
repositories, and the package name/title/description the action renders.

Side effects

• A request for a package that doesn't exist on the backend either now
  returns 404 (Package::UnknownObjectError) instead of 500.
• No change for non-scmsync projects: the fallback only runs when the DB
  lookup returns nil, which for a normal missing package already raised
  in check_package_access before this line.
• No migration, no config change, no feature toggle — nothing to do at
  deploy time.

How to verify

Automated (new spec GET #binary_packages for a package of an scmsync project; whole file green, 51 examples):

docker compose run --rm frontend bundle exec rspec spec/controllers/public_controller_spec.rb

Manual:

1. Give a project an scmsync URL: edit the project meta and add
   <scmsync>https://example.com/whatever.git</scmsync> (web UI meta
   editor, or osc meta prj <project>).
2. Request a package of that project that has no package entry in the
   database:
   curl -i http://localhost:3000/public/binary_packages//
3. On master this responds 500. With this PR it responds 200 (or
   404 if the package also doesn't exist on the backend).

AI use is disclosed via the Assisted-by: trailer on the commit; the
change was reviewed and tested locally before submitting.

Fixes #20224