Validate UTC upload times in pylock metadata

[emme1t]

Pylock.from_dict() currently accepts upload-time values with no timezone or with a nonzero UTC offset for archives, sdists, and wheels. It also serializes those values unchanged. The pylock specification requires the upload date and time to be recorded in UTC; the sdist and wheel fields reference the same requirement.

Validate that the datetime's UTC offset is zero through the existing _get_as path. Invalid values now raise PylockValidationError with their full field context, such as packages[0].wheels[0].upload-time. The existing validation API rejects data that violates the specification.

The parameterized tests cover all three artifact types with timezone-naive values, positive and negative offsets, UTC, a named zero-offset timezone, and omitted upload times. Valid values retain their round-trip representation.

Validation on Windows with Python 3.13.13:

• Added invalid-input regressions on the original source: 9 failures because validation accepted the values.
• Full configured suite: 62,452 passed, 1 skipped, 427 deselected by the existing default property-test selection.
• packaging.pylock coverage: 100% statements and branches (332 statements, 116 branches).
• Ruff lint/format and mypy pass for both changed files.
• git diff --check passes.

AI assistance: OpenAI Codex prepared the change, executed the tests, and performed a separate review of the specification and validation behavior.