fix(api): validate blacklist channel arch on package update

[tagadearpit]

Summary

Package updates did not validate the architecture of newly blacklisted channels. As a result, an amd64 package could be updated with an aarch64 channel in its blacklist, even though package creation already rejected the same mismatch.

This change calls the existing checkMatchingArch validation from updatePackageBlacklistedChannels before blacklist entries are inserted and adds regression coverage for the update path.

Tracking issue: flatcar/nebraska#1596

Tests

The following checks pass:

NEBRASKA_DB_URL=postgres://postgres:nebraska@127.0.0.1:5432/nebraska_tests?sslmode=disable&connect_timeout=10 go test ./pkg/api/... -run '^TestUpdatePackageArchMismatch$' -count=1 -v
NEBRASKA_DB_URL=postgres://postgres:nebraska@127.0.0.1:5432/nebraska_tests?sslmode=disable&connect_timeout=10 go test -p 1 ./pkg/api/... -count=1
go vet ./pkg/api/...