Geo: Container registry sync jobs should fail on failure to pull

What does this MR do and why?

Changes Geo::ContainerRepositorySync to raise an error if it cannot connect to the primary container registry

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

1. Setup a test Geo instance using Container Repository replication
2. Break the repository replication by setting gitlab_rails['registry_issuer'] = "somethingwrong" in gitlab.rb and running gitlab-ctl reconfigure
3. Push a new container to the primary, and check that Geo reports the sync as successful, but you cannot pull the image from the secondary
4. Apply the changes from this MR, and repeat the previous step. After push, the container replication should be marked as failed

Related to #431944 (closed)