* fix: merge version ranges when adding existing package signer
Previously, add_package_signer unconditionally inserted the new
version range, overwriting any existing authorization for that signer.
Now it OR-merges the new range with the existing one, so running
signer add multiple times accumulates permissions rather than
replacing them.
* add --merge flag to registry package signer add
Default behavior remains overwrite. When --merge is passed, the new
version range is OR-merged with the existing one, allowing admins to
accumulate permissions incrementally.
* add missing attribute to TS type
* make merge optional
* upsert instead of insert
* VersionRange::None on upsert
26a68afdef