As found while fixing the `go` datasource in #45949, calls to
`withCache()` lean on the default of `cacheable: true`, which can lead
to private packages being incorrectly cached.
This could lead to cross-pollination of access to private package
metadata, so we should be clear where we're not explicitly deciding
whether to cache or not, which we can do so with a new linting rule.
We'll make new findings an error, and existing issues appear a sa
warning.
As we improve coverage, we'll then remove this rule and make it so
`cacheable` is a required flag in `CachedOptions`.
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
Jamie Tanna
295cd65124