Automatic package updates bypass custom feeds exclusion

[Tbaile]

Steps to reproduce

• Add a custom feed via customfeeds.list (see docs/design/distfeed.md).
• Wait for the nightly package-update cron to run, or trigger a package update check/install from the UI.

Expected behavior

Automatic update paths (nightly cron and UI update flow) should ignore customfeeds.list and only consider packages from the official NethSecurity distfeed, since custom-feed packages are not rebuilt or QA'd by NethSecurity.

Actual behavior

Nightly updates and the UI's update check/install flow call apk directly, so custom feeds are considered like any other repo. This can cause a package to be upgraded from an upstream/custom feed by mistake, bypassing NethSecurity's QA channel. Manual apk invocations are unaffected either way.

Components

ns-plug 1.3.1
ns-api 3.7.1

[Tbaile]

QA: try to add the apk packages from upstream following the manual: https://dev.nethsecurity.org/design/distfeed/#upstream-openwrt-repositories

Then try to update the packages through the UI, if it works no packages will be prompted for update.
A double check could be to run apk update through the CLI, there you should be able to see various updates available.