dependency-manager

We're doing a bunch of code quality cleanup, and as part of that effort I'd like to implement some additional lints/coding conventions. There will be a lot of manual changes here, so I think these will be some items to have multiple people tackle.

In no particular order:

• Add ban-relative-imports = true to .flake8 and remove relative imports from the repo.
• ~Add `flake8-type-checki

Describe the proposed change(s).

• aws-machine-image
• cargo
• composer
• docker
• git
• gradle
• hashicorp
• helm
• hex
• ivy
• loose
• maven
• node
• npm
• nuget
• pep440
• poetry
• regex
• rez
• ruby
• ruby/strategies
• semver-coerced #1

Describe the bug
CodeQL show that we are logging paths directly. We should instead escape and then log them.

To Reproduce
Results are shown here: https://github.com/gomods/athens/pull/1748/checks?check_run_id=4567576462

Expected behavior

We can simply log escaped paths provided by net/url: https://pkg.go.dev/net/url#URL.EscapedPath

Additional context
Add an

If CPM_SOURCE_CACHE is set to an empty string, CPM fails with file DOWNLOAD error: cannot create directory '/cpm' - Specify file by full.

We currently don't support compiler options which are two parameters, like -encoding UTF-8, and commas also seem to be invalid in parameters, presumably excluded by some regex...

Currently build agents run mbt version command at the end of the build. We should add a smoke test for each command (mbt describe | build | apply) to this list for release builds.