Verify all: only use creds for local images

Hannes Hörlrequested to merge
hhoerl/39058-fix-image-verify into main

What does this MR do?

Verify all: only use creds for local images

We should, in fact: can, only use the CI creds when checking local images, ie. images in GitLab's repos.

This is a follow-up to Pull in some changes from the security fork (!5906 - merged)

Why was this MR needed?

To fix the pipeline.

What's the best way to test this MR?

  • merge, wait for the pipeline run against main and see the "verify bleeding edge resources" succeed
  • set CI_REGISTRY_USER and CI_REGISTRY_PASSWORD (e.g. to a PAT) and run mage resources:verifyAll locally, and see that succeed

What are the relevant issue numbers?

related: #39058+

Merge request reports