Add audited local provider icon import

[konojunya]

Summary

• add stack icons import for user-selected AWS, Google Cloud, and Azure official archives
• pin complete archive hashes and exact icon entry allowlists for 18 provider services
• sanitize untrusted SVG with strict XML, structure, attribute, URL, size, and path checks while preserving artwork
• emit provider-pack manifests and notices atomically without bundling, downloading, or uploading vendor asset bytes
• document source, terms, provenance, supported IDs, dependency licenses, and the local-only security boundary

Verification

• cargo test --locked
• STACK_SPECIFICATION_DIR=../specification cargo test --features conformance --test formatter-conformance --locked
• cargo clippy --all-targets --all-features --locked -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --locked
• STACK_SPECIFICATION_DIR=../specification cargo llvm-cov --all-features --locked --fail-under-lines 90 --fail-under-functions 95 --fail-under-regions 90 (92.83% regions, 99.24% functions, 93.74% lines)
• cargo +1.85.0 test --locked
• cargo +1.85.0 clippy --all-targets --all-features --locked -- -D warnings
• cargo build --release --locked
• python3 scripts/validate-render.py
• imported the audited official archives: AWS 7, Google Cloud 6, Azure 5
• validated every generated pack against the stack-sh/theme provider-pack contract
• raster-compared all 18 original/processed SVG pairs at 512 x 512 with zero changed pixels

No vendor icon bytes or downloaded archives are included in this pull request.