Add a new patch application path that uses `patch -p1`, so CPM packages fetched as tarballs can have patches applied to them. Tarball-extracted directories have no `.git` repository and so cannot use `git apply` or `git am`. The existing git-mode path is retained unchanged for packages fetched as git clones. The fetch mode is detected from `versions.json` (`git_url`/`git_tag` vs `url`/`url_hash`) and the patch script dispatches accordingly.

Also includes a few adjacent fixes uncovered while adding the above:

- Fix `pinning_write_file.cmake` to respect mode switching when an override provides git fields for a package whose default is URL-mode. Previously the fallback to default JSON could incorrectly detect URL-mode even when the override explicitly switched to git-mode.
- Update `verify_generated_pins` to handle URL-mode packages in pin verification, checking `url`/`url_hash` fields instead of `git_tag`/`git_shallow`.
- Update `cpm_package_override-multiple` tests to provide `git_url` alongside `git_tag` in overrides so that partial git overrides remain valid regardless of whether the default entry is git- or url-mode.

### Test coverage

Splits the existing patch-command tests into explicit `-git` and `-tarball` variants for each scenario (regular, embedded, required, required-fails) and adds `-diff-git`/`-diff-tarball` pairs so both `.patch` and `.diff` files are exercised in both modes. Each test specifies its fetch mode explicitly in `override.json` (`git_url`/`git_tag` for `-git` tests, `url`/`url_hash` for `-tarball` tests) rather than relying on the default, so the tests remain correct regardless of how `versions.json` evolves. The override is applied before `rapids_cpm_package_details_internal` so the explicitly declared mode is used for the test's pre-populate step.

Coverage matrix:

|              | git mode | tarball mode |
|--------------|----------|--------------|
| .diff        | new      | new          |
| .patch       | existing | new          |
| inline patch | existing | new          |
| required     | existing | new          |
| required-fails | existing | new        |

This PR is a prerequisite for #1005 (converting `versions.json` entries to tarballs), since several of the packages being converted have patches applied via overrides in downstream RAPIDS projects.

Authors:
  - Bradley Dice (https://github.com/bdice)

Approvers:
  - Robert Maynard (https://github.com/robertmaynard)

URL: #1011