Classify image-pull access-denied errors as ConfigurationError

What does this MR do?

Classify image-pull access-denied and authentication-required errors as ConfigurationError instead of ImagePullFailure.

Patterns matched

In ClassifyImagePullFailure(), the following substrings now route to ConfigurationError:

• pull access denied
• access to the resource is denied
• no basic auth credentials
• repository does not exist or may require
• unauthorized
• authentication required

These cover both Docker daemon and containerd error formats. A registry- side authentication hiccup that surfaces as 401 here is misattributed to config in the rare case it occurs; those incidents are detected separately by the registry's own monitoring.

Why was this MR needed?

To fix incorrect assignments of failure reasons.

What's the best way to test this MR?

What are the relevant issue numbers?

• Part of Reclassify plain errors and image-pull failures... (#39535 - closed)