add missing unpackaged metadata option

[yippie]

Add support for the Salesforce "unpackaged Metadata" option when creating package versions.

https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_dev2gp_unpackaged_md.htm

Fixes #3989

[jstvz]

Adds an unpackaged_metadata_path option to create_package_version so the build org used during package version creation can deploy extra metadata that Apex tests in the package depend on. The option writes unpackaged-metadata.zip into VersionInfo and sets package_descriptor["unpackagedMetadata"], matching the SFDX unpackagedMetadata semantics. Tests assert presence in the positive case and absence in the negative case.

Two correctness issues to address before merge (inline):

1. The new block runs every time _create_version_request is called, including the two dependency calls at lines 684 and 719. The configured path will be attached to every unlocked dependency package, not only the main package. The existing dependencies block at line 432 gates on is_dependency; mirroring that gate looks correct.

2. A missing unpackaged_metadata_path directory currently surfaces as a raw FileNotFoundError from convert_sfdx_source. Validating in _init_options would give a clearer error.

Two minor cleanups (non-blocking): the new version_info.writestr call sits outside the with convert_sfdx_source(...) block (the analogous settings block keeps it inside; works because the zip builder buffers in BytesIO, but the asymmetry reads like a scope bug), and the new tests re-import BasePackageZipBuilder locally even though it is imported at module scope.

The descriptor key, the zip entry, and the test coverage all line up with the SFDX behavior the linked issue (#3989) calls out.

[jstvz]

Lint is clean locally (ruff check passes). The "Lint / Lint" CI failure on this SHA is a workflow infrastructure issue (fatal: couldn't find remote ref feature/add-unpackaged-metadata-support) unrelated to code quality.

The remaining failing checks (3.14 unit tests, Robot, Test SFDX CLI, Org-connected) reproduce on every PR right now and trace to the SF CLI 2.136 [REDACTED] token issue (#3987) plus the Python 3.14 matrix cap. Out of scope here.

LGTM.