Remove moderated package and version assets after 3 years.

[isoos]

• Reuses existing remove package logic, with the following updates:

  • reordering delete operations, in order to prevent information loss if the process fails mid-deletion,
  • also updates replacedBy fields if they are referencing the moderated package,
  • also deleted AuditLogRecord entities, otherwise the integrity check fails on them, (we could update the integrity checks to accept ModertedPackage existence in such cases though)
  • also adds previously deleted versions to the moderated package entity's list

• Deleting package version is simpler in comparison, it needs to remove only a few references.

• Deleting moderated publisher or user is implemented separately, left TODO for them.