verify stable/bleeding-edge resources hits Docker Hub anonymous rate limit

verify stable resources and verify bleeding edge resources (.gitlab/ci/postrelease.gitlab-ci.yml) run mage resources:verifyAll, which checks every published image exists via skopeo inspect (magefiles/build/checker.go). Docker Hub images (registry.hub.docker.com/gitlab/gitlab-runner*) are checked unauthenticated.

The tag matrix is large: scripts/pusher/helper-images.json (49 templates) + scripts/pusher/runner-images.json (5 templates), each expanded into ~3 tags by make print_image_tags. That'''s roughly 160 unauthenticated manifest checks against Docker Hub per run - over Docker Hub'''s 100-pulls-per-6-hours anonymous limit, on its own, regardless of any other traffic sharing the runner'''s IP.

Example failure: https://gitlab.com/gitlab-org/gitlab-runner/-/jobs/15372831323

Fix: authenticate Docker Hub checks the same way registry.gitlab.com checks are already authenticated, using DOCKER_HUB_USER/ DOCKER_HUB_PASSWORD (already used to push these images in .gitlab/ci/release.gitlab-ci.yml).

Related history: this credential-attach logic has caused one prior regression - !5906 (merged) attached GitLab.com credentials to every image check unconditionally, which broke Docker Hub checks with 401s; fixed by !5914 (merged) by scoping credentials to registry.gitlab.com only. This issue'''s fix adds a second, equally scoped branch for Docker Hub - never sharing credentials across registries.