Publication should use endpoint `https://api.eclipse.org/openvsx/publisher_agreement/{username}` to check for a valid publisher agreement

[netomi]

Currently, during publication only the public eclipse profile of the user is retrieved to check whether the user has signed the publisher agreement. However, the information present from this endpoint is cached and not up-to-date.

So it can happen that you sign the publisher agreement, which is then shown in the service, however you cant publish as the information is retrieved again from the public profile which still states that you have not signed the agreement yet.

The cache time used to be 15m, it is now reduced to 5min, however, during publication we should not use cached data but rather use endpoints that return up-to-date data.

[autumnfound]

To add a little context, the profile alone is cached for 5 minutes to keep code reactive but stable with high demand. This should only last at most 5 minutes as it is only cached in the origin API. For the publisher agreement, we made sure that there was a separate endpoint that would retrieve the most recent signature of the publisher agreement and is uncached for cases like this. If the publishing process makes use of the above endpoint, it should be immediately reactive to updates to the agreement status.