Add timeout and retry/backoff to Cloudsmith API requests

[Copilot]

requests.get and requests.put in exemptions/update_policy.py had no timeout, allowing CI to hang indefinitely if the Cloudsmith API stalled.

Changes

• Explicit timeout — REQUEST_TIMEOUT = 30 s applied to both GET and PUT calls
• Retry with backoff — urllib3.util.retry.Retry + HTTPAdapter retries up to 3×on 5xx and connection errors with 0.5 s/1 s/2 s exponential backoff; no new dependencies (bundled with requests)
• Single shared session — _session built once at module level, avoiding adapter recreation per request
• HTTPS-only adapter mount — HTTP mount omitted so the ****** cannot be sent in cleartext

_retry_strategy = Retry(
    total=3,
    backoff_factor=0.5,
    status_forcelist=[500, 502, 503, 504],
    allowed_methods=["GET", "PUT"],
)

def _build_session() -> requests.Session:
    session = requests.Session()
    adapter = HTTPAdapter(max_retries=_retry_strategy)
    session.mount("https://", adapter)  # HTTPS only — no plaintext token leakage
    return session

_session = _build_session()

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.