Nebraska: validate channel architecture when updating a package blacklist

[tagadearpit]

Summary

flatcar/nebraska does not validate channel architecture when a package's channel blacklist is modified through the package update path.

Affected component

Nebraska backend package administration, specifically UpdatePackage and updatePackageBlacklistedChannels in backend/pkg/api/admin/packages.go.

Reproduction

Create an application with an aarch64 channel and an amd64 package that has no blacklisted channels. Then update the package through PUT /api/apps/{appID}/packages/{packageID} with that aarch64 channel in channels_blacklist.

The equivalent package-creation request rejects the mismatch with ErrArchMismatch, but the update request currently succeeds and stores the mismatched blacklist entry.

Expected behavior

Updating a package's channel blacklist should enforce the same architecture invariant as package creation and reject a channel whose architecture differs from the package with ErrArchMismatch.

Proposed fix

Call the existing checkMatchingArch validation from updatePackageBlacklistedChannels before inserting blacklist entries, and add regression coverage for an amd64 package updated with an aarch64 blacklisted channel.

This issue affects the Nebraska repository: https://github.com/flatcar/nebraska

[dongsupark]

Transferred the issue from Flatcar to here