credhelper: add static-Bearer mode

[chrissmiller]

Summary

Add a static-Bearer authentication mode to credhelper.RegistryHostsFromDockerConfig. When a docker-credential helper returns Username == "<static_bearer>", the helper's Secret is installed as a literal Authorization: Bearer <Secret> header on the RegistryHost, and the docker challenge-response auth flow is skipped entirely.

Motivation

Some registries authenticate the caller via a pre-minted bearer token rather than an OAuth2 realm exchange. Concretely: Datadog's Terrapin Forwarder accepts the calling sandbox's identity JWT directly as a bearer, with no token endpoint to exchange against. Today, RegistryHostsFromDockerConfig always wires up a docker.NewDockerAuthorizer that runs the WWW-Authenticate challenge flow — either Basic-auth or OAuth2 token exchange — neither of which matches "send this token verbatim."

The new path mirrors go-containerregistry's "<token>" username convention, but tighter: "<token>" still goes through an OAuth2 refresh_token exchange against the challenge realm. "<static_bearer>" skips that and just sets the header.

Behavior

• If the docker-credential helper for a host returns Username: "<static_bearer>", the host is configured with:
  • Header = http.Header{"Authorization": []string{"Bearer <Secret>"}} — applied to every request via containerd's RegistryHost.Header merge (remotes/docker/resolver.go).
  • Authorizer = nil — challenge-response auth flow disabled.
• All other helper outputs use the existing challenge-response flow unchanged.

Test plan

• New unit test TestRegistryHostsStaticBearerSentinel covers the sentinel path: confirms the Authorization: Bearer … header is installed and the Authorizer is nil.
• bazel run //:bootstrap && bazel test //... — 6/6 pass on this branch (buildifier_test, docs:update_test, go/cmd/ocitool:go_default_test, go/pkg/credhelper:credhelper_test, go/pkg/deb2layer:go_default_test, go/pkg/ociutil:go_default_test).
• End-to-end verified by building a patched ocitool and pulling a multi-arch image (registry.ddbuild.io/images/compute-toolbox@sha256:d45510ad…) through our forwarder proxy from inside a sandbox: manifest list → platform manifests → config + layer blobs all 200 OK. Without the patch the same flow gets 401 Unauthorized because the forwarder's challenge isn't an OAuth2 token endpoint.

🤖 Generated with Claude Code