Fixes #8492.

This introduces "nopfs" as a preloaded plugin into Kubo.

It automatically make Kubo watch *.deny files found in:

- /etc/ipfs/denylists
- $XDG_CONFIG_HOME/ipfs/denylists
- $IPFS_PATH/denylists

(files need to be present before boot in order to be watched).

Debug logging can be enabled with `GOLOG_LOG_LEVEL="nopfs=debug"`.

All blocks are logged to "nopfs-blocks", so logging requests for blocked
content can be achieved with
`GOLOG_LOG_LEVEL="nopfs-blocks=warn"`:

```
WARN (...) QmRFniDxwxoG2n4AcnGhRdjqDjCM5YeUcBE75K8WXmioH3: blocked (test.deny:9)
```

Interactive/gateway users will also receive errors as responses but with less details:

```
Error: /ipfs/QmQvjk82hPkSaZsyJ8vNER5cmzKW7HyGX5XVusK7EAenCN is blocked and cannot be provided
```

One particularity to keep in mind is that GetMany() will silently drop blocked
blocks from the response (a warnings are logged). AddMany() will act
similarly and avoid adding blocked blocks.

The code implementing all this is actually in nopfs:

- https://github.com/ipfs-shipyard/nopfs (main library)
- https://github.com/ipfs-shipyard/nopfs/tree/master/ipfs (wrappers)

The interpretation of the list rules and block detection is well tested, but a
general review might be in order.

Includes dependency update from ipfs-shipyard/nopfs#25

CLI works as expected, gateway does not respect the rule
(needs investigation)

cosmetic change to error message, this should be more robust

… fetcher

this ensures we test something other than default sha256

Ref. ipfs-shipyard/nopfs#28

adds missing tests for "no fetch" gateways one can expose,
in both cases the offline mode is done by passing custom
blockservice/exchange into path resolver, which means
global path resolver that has nopfs intercept is not used,
and the content blocking does not happen on these gateways.

needs to be fixed, but at least now we have tests that
fail until it is fixed.

this fixes the problem described in
#10161 (comment)
by adding explicit offline path resolvers that are backed
by offline exchange, and using them in NoFetch gateways
instead of the default online ones

requires ipfs/boxo#497
which is based on top of the boxo already used in kubo master
to avoid issues caused by ilater commits in boxo main