Adds a sync-packages job to the child pipeline that copies generic
packages from the security mirror's package registry to the canonical
project's package registry.

The job looks up the package by CI_PROJECT_NAME and CI_COMMIT_TAG,
lists all files, then downloads each from the security mirror and
re-uploads to canonical. Exits gracefully if no generic package exists
for the tag.

Token type is auto-detected from prefix (gldt- for deploy tokens,
glpat- for PATs) to use the correct auth header. File transfers use
a temp directory with trap cleanup.

Updates auth docs: CANONICAL_REGISTRY_TOKEN now requires both
write_registry and write_package_registry scopes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: sync generic packages via GitLab Package Registry API (MR 3/4)

See merge request !1443

## [3.22.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-04-28)

### Features

* sync generic packages via GitLab Package Registry API ([7d942109](7d942109))