feat(auth): add ForceBasicAuth to override Bearer challenges

[TerryHowe]

Summary

Part 3 of 3 splitting #1141 into reviewable chunks.

Add a ForceBasicAuth bool field to auth.Client. When true, a Bearer challenge from the registry is rewritten to a Basic challenge before credential handling. Useful for registries that advertise Bearer but also accept HTTP Basic for the same credential pair.

Implementation

Three lines in Client.Do(), right after parseChallenge() and before the existing scheme switch:

```go
if c.ForceBasicAuth && scheme == SchemeBearer {
scheme = SchemeBasic
}
```

The rest of the basic-auth path runs unchanged. The override bypasses the bearer flow entirely, so it does not interact with the token-fetching logic.

Independence

Independent of PRs A (#1180) and B (#1181). Based directly on `main`. Can land in any order relative to the other two.

Test plan

• `go test -mod=mod ./registry/remote/auth/...` — passes
• New `TestClient_Do_ForceBasicAuth_OverridesBearer` verifies: registry sends Bearer challenge → client retries with Basic header → 200
• CI on this PR

Replaces #1141 together with PRs A and B.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.13%. Comparing base (3d90c80) to head (e0e0275).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1182      +/-   ##
==========================================
+ Coverage   83.06%   83.13%   +0.07%     
==========================================
  Files          82       82              
  Lines        5756     5758       +2     
==========================================
+ Hits         4781     4787       +6     
+ Misses        602      599       -3     
+ Partials      373      372       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.