Fix VariantPaths: strict v2.0 serialization, src arch support, and public Location API

[guillermodotn]

Summary

• Fix source_repository and other paths keyed by pseudo-arches like "src" being silently dropped during serialization and deserialization
• Add set_location() / get_location() public API for setting Location objects on variant paths
• Replace setattr loop with explicit attribute declarations for LSP visibility
• Remove silent synthesis fallback in _serialize_v2 — raises ValueError if no Location is set
• Remove silent fallback in _deserialize_v2 — raises TypeError on malformed v2.0 data
• _serialize_v1 handles Location objects in field dicts by extracting local_path
• convert.py uses the public API instead of accessing _locations directly

Fixes:

• Cannot set separate url and local_path when assigning to variant.paths #227
• pylsp/jedi False Positive Type Warnings #228
• source_repository not serialized to composeinfo.json #229

[lubomir]

I have closed #229, that's not really a problem with the code, but bad usage. It might make sense to emit some warnings if the arch key under any path doesn't match architecture configured for the variant though.

[lubomir]

Looks good to me.

[lubomir]

In theory this should never be the case. Even for source repository, there should not be a pseudoarch in the dict.