PyPI: fixed package downloads failing (503) in integrated mode when the upstream JSON simple index uses relative URLs (e.g. JFrog Artifactory).
Maven: a hide verdict no longer returns 403 for a pinned .pom/snapshot; hidden versions are dropped from maven-metadata.xml but a pinned request still resolves, matching npm/PyPI/NuGet. Only deny hard-blocks.
