perf: optimize dependency resolver with map-based deduplication

[matthyx]

Summary

Replace strset-based deduplication with efficient map-based approach to avoid external dependency overhead. Use struct keys instead of string concatenation for relationship tracking, eliminating temporary string allocations.

Changes

• Add pairKey struct to track relationship pairs without string concatenation
• Replace strset.New() with map[string]struct{} in deduplicate()
• Use pairKey struct in Resolve() to avoid string key construction
• Remove dependency on scylladb/go-set/strset

Performance Impact

Benchmarks

Run on AMD Ryzen 9 7900:

Deduplication benchmarks:

• BenchmarkDeduplicate_VeryLarge (5000 strings): 85566 ns/op, 237232 B/op, 27 allocs/op

Relationship resolution benchmarks:

• BenchmarkResolve_CraftedRelationships (100 pkgs): 59404 ns/op, 86203 B/op, 1227 allocs/op
• BenchmarkResolve_CraftedRelationships_Large (500 pkgs): 402018 ns/op, 513215 B/op, 6046 allocs/op
• BenchmarkResolve_CraftedRelationships_VeryLarge (1000 pkgs): 857822 ns/op, 1.03 MB, 12063 allocs/op

Allocation Reduction

The map-based deduplication avoids:

• String concatenation overhead for relationship keys (previously: string(providingPkgID) + "-" + string(dependantPkg.ID()))
• strset internal allocations and garbage collection pressure
• External dependency (scylladb/go-set/strset)

For a 1000-package project with complex relationships, this reduces allocations and memory pressure while providing O(1) lookup performance.

Rationale

This change optimizes the dependency resolution hot path used by all package catalogers. Benefits:

1. Eliminates string concatenation: Using struct keys avoids creating temporary strings for relationship tracking
2. Removes external dependency: Reduces dependency surface area and Go module complexity
3. Consistent with Go idioms: map[K]struct{} is the standard Go pattern for sets
4. Same performance characteristics: O(1) lookups with less overhead than strset

The reviewer noted that while map[]struct{} is more verbose than strset, it's the standard Go approach and avoids temporary allocations in the hot path.

Testing

• All existing dependency resolver tests pass
• Added comprehensive benchmarks for deduplication and relationship resolution
• Benchmarks demonstrate consistent memory and allocation characteristics

Related

Closes: Part of memory optimization effort described in PR #4585 (which will be closed in favor of focused, individually-benchmarked PRs)