Add comment to container registry auth service

Comment explains why we still have authentication without user object
there. The legacy authentication mechanism should be removed in 10.0.