feat(kubernetes): allow ignoring pull secrets - #2315

Motivation:
When a TaskRun/PipelineRun's ServiceAccount has both
imagePullSecrets and mounted secrets targeting the same OCI
registry, the vendored go-containerregistry keychain consolidates
both sets and returns the first match, which is always the
read-only imagePullSecrets credential. The OCI storage backend
(pkg/chains/storage/oci/legacy.go, still the active auth path
wired in pkg/chains/storage/storage.go despite its "Deprecated"
doc-comment on the Backend type) only ever pushes signed
attestations, so resolving a read-only credential makes the push
fail with an auth error even though a push-capable credential is
available in secrets.

This addresses the ServiceAccount-level case described in the
issue; the PodTemplate-level case was already fixed in a prior,
separate change.

Approach:
- Bump the vendored github.com/google/go-containerregistry
  pkg/authn/kubernetes module to the commit that merged upstream's
  IgnorePullSecrets option
  (google/go-containerregistry#2315),
  which lets the keychain skip both the ServiceAccount's
  imagePullSecrets and any explicit pull secrets.
- Set IgnorePullSecrets: true when building the k8schain options
  used by the OCI backend, since this keychain is only ever used
  to push, never to pull.

Validation:
- go build ./... passes.
- make test-unit passes for all packages.
- make golangci-lint PKG=./pkg/chains/storage/oci/... reports 0
  issues.
- Added TestK8schainOptions_IgnoresImagePullSecrets, confirmed to
  fail if IgnorePullSecrets: true is removed and to pass with the
  fix, asserting the OCI backend's k8schain options are built with
  IgnorePullSecrets set.
- Not run: no live cluster is available in this environment, so
  the fix was not reproduced end-to-end against a real registry.
  Correctness instead relies on the upstream library's own test
  coverage for IgnorePullSecrets plus the added unit test
  confirming this backend threads the option through.

Report: #1336

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

crane 0.21.7

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>## What's Changed
* tarball: return error instead of panicking on missing rootfs.diff_ids by @iahsanGill in google/go-containerregistry#2304
* gcrane: honor --platform flag in copy by @iahsanGill in google/go-containerregistry#2307
* mutate: verify layer digests in Extract and Time by @momenashrafff in google/go-containerregistry#2303
* tarball: close layer readers during Write by @nandbhat in google/go-containerregistry#2308
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in google/go-containerregistry#2311
* build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @dependabot[bot] in google/go-containerregistry#2312
* BUGFIX: Fail with error when read exceeds maximum by @inteon in google/go-containerregistry#2328
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in google/go-containerregistry#2327
* fix(name): anchor loopback registry detection by @rohan-patnaik in google/go-containerregistry#2314
* Reject symlinks in OCI layout blobs by @mosskappa in google/go-containerregistry#2306
* fix(crane): avoid creating export tar on pull failure by @Haihan-Jiang in google/go-containerregistry#2318
* feat(kubernetes): allow ignoring pull secrets by @rohan-patnaik in google/go-containerregistry#2315
* fix(name): preserve localhost registry references by @rohan-patnaik in google/go-containerregistry#2316
* pkg/registry: export ErrNotFound by @malt3 in google/go-containerregistry#2176
* pkg/registry: export RedirectError by @malt3 in google/go-containerregistry#2177
* build(deps): bump the go-deps group across 1 directory with 2 updates by @dependabot[bot] in google/go-containerregistry#2343
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in google/go-containerregistry#2344
* fix: prevent SSRF in google.List() pagination by @tufstraka in google/go-containerregistry#2332
* internal/gzip: fix goroutine leak in ReadCloserLevel by @amarkdotdev in google/go-containerregistry#2347
* fix(transport): apply refreshed bearer token after cross-host redirect by @64johnlee in google/go-containerregistry#2337
* build(deps): bump the go-deps group across 3 directories with 4 updates by @dependabot[bot] in google/go-containerregistry#2348
* fix(tarball): normalize paths when matching files by @bstoll in google/go-containerregistry#2334
* transport: do not re-attach bearer token after cross-host redirect by @evilgensec in google/go-containerregistry#2349
* Bump CI go version to 1.26.4 by @Subserial in google/go-containerregistry#2350

## New Contributors
* @momenashrafff made their first contribution in google/go-containerregistry#2303
* @nandbhat made their first contribution in google/go-containerregistry#2308
* @inteon made their first contribution in google/go-containerregistry#2328
* @rohan-patnaik made their first contribution in google/go-containerregistry#2314
* @mosskappa made their first contribution in google/go-containerregistry#2306
* @Haihan-Jiang made their first contribution in google/go-containerregistry#2318
* @tufstraka made their first contribution in google/go-containerregistry#2332
* @amarkdotdev made their first contribution in google/go-containerregistry#2347
* @64johnlee made their first contribution in google/go-containerregistry#2337
* @bstoll made their first contribution in google/go-containerregistry#2334

**Full Changelog**: https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7</pre>
  <p>View the full release notes at <a href="https://github.com/google/go-containerregistry/releases/tag/v0.21.7">https://github.com/google/go-containerregistry/releases/tag/v0.21.7</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!11861