Also authenticate docker.io image checks against Docker Hub

Lachlan Grantrequested to merge
docker-hub-auth-verify-resources-docker-io into main

What does this MR do?

Extends the Docker Hub credential case in dockerInspectArgs (magefiles/build/checker.go, added in !6967 (merged)) to also match images referenced via the docker.io/ prefix (eg. docker.io/gitlab/gitlab-runner-helper:bleeding), not just registry.hub.docker.com/. Adds table-driven test cases in checker_test.go covering the docker.io/ prefix, including case-insensitive matching and that it never receives GitLab.com credentials.

Why was this MR needed?

Follow-up requested on !6967 (merged) by @daniel-keenan, based on a suggestion from GitLab Duo: the resource list may reference Docker Hub images via docker.io/ rather than registry.hub.docker.com/, and those would otherwise fall through unauthenticated and hit Docker Hub's anonymous pull rate limit.

Notes for reviewers

This branch is stacked on top of !6967 (merged) (docker-hub-auth-verify-resources), since dockerInspectArgs doesn't exist on main yet. Marked draft and depends on !6967 (merged) merging first; once it does, this diff will shrink to just the docker.io/ addition.

Edited by Lachlan Grant

Merge request reports