Report Basic-auth registry failures as credential errors

[kiwigitops]

Addresses apple/container#1538.

Summary:

• preserves the existing Bearer-token path when a registry advertises Bearer auth
• reports Basic-auth 401/403 responses with supplied credentials as access denied or wrong credentials
• adds focused coverage for Basic-only WWW-Authenticate challenges with and without credentials

Verification:

• git diff --check

[kiwigitops]

Quick bump. Happy to adjust the error wording or tests if this should line up with a different registry auth path.