Support credential helpers for pull

[Harshal96]

Summary

• propagate credential helper and Docker config settings through pull repository rules and the images module extension
• pass credential auth environment into pull-tool executions and lazy DownloadBlob actions
• prefer configured Bazel credential helpers before Docker config keychains so a broken Docker config helper does not block pulls
• add regression coverage for helper precedence and lazy blob action environment wiring
• regenerate generated pull/extensions docs

fixes #473

Validation

• bazel test @rules_img_pull_tool//pkg/auth/... @rules_img_tool//pkg/auth/... //img/private:download_blobs_test
• bazel test //docs:all //util:buildifier.check
• bazel build //img/private/repository_rules:all //img/private/extensions:all //img:pull //img:extensions @rules_img_pull_tool//pkg/auth/registry:registry @rules_img_tool//pkg/auth/registry:registry