Add HTTP and archive pipeline helpers

[machado144]

Summary

• add curl-like pipekit http helpers for HTTP(S) requests, JSON extraction, retries, uploads, verbose output, and insecure TLS mode
• add pipekit http chain for dependent request flows with jq-style captures and {{var}} interpolation
• allow pipekit http chain - to read JSON/YAML plans from stdin, including heredocs for short one-off flows
• add pipekit archive pack/list/unpack support for zip, tar, tar.gz, tar.xz, and tar.zst with safe extraction checks
• update README, command reference, examples, and CI docs for the new commands and Go 1.25/toolchain 1.25.11
• update CI to Go 1.25 with updated x/net so vuln scanning is clean

HTTP chain example

pipekit http chain flow.yaml --expect-status 200 --verbose runs each step in order, captures values from JSON responses, and makes them available to later steps as {{var}} placeholders in URLs, headers, raw bodies, and JSON bodies.

steps:
  - name: auth
    method: POST
    url: https://api.example.com/token
    json: '{"client":"ci"}'
    expectStatus: [200]
    capture:
      token: .access_token
  - name: deploy
    method: POST
    url: https://api.example.com/deploys/{{token}}
    headers:
      Authorization: Bearer {{token}}
    json: '{"ref":"main"}'
    expectStatus: [201]
    capture:
      deploy_id: .id

The command prints structured JSON with final captured vars and each step's HTTP status.

Heredoc chain example

For short two- or three-step flows, the plan can be passed inline without a temp file:

pipekit http chain - --expect-status 200 <<'YAML'
steps:
  - name: auth
    method: POST
    url: https://api.example.com/token
    json: '{"client":"ci"}'
    capture:
      token: .access_token
  - name: deploy
    method: POST
    url: https://api.example.com/deploys/{{token}}
    headers:
      Authorization: Bearer {{token}}
    json: '{"ref":"main"}'
    expectStatus: [201]
YAML

Tests

• go test ./...
• go build ./...
• make test-integration
• govulncheck ./...