fix(login): avoid false login failures for robot accounts

[SeeyaVhora]

Summary

• Running harbor login with valid robot account credentials can incorrectly trigger an authentication failure during connection validation.
• This behavior impacts non-interactive workflows and CI/CD pipelines that rely on automated robot account authentication.
• The issue occurs even when the supplied credentials themselves are valid.

Root Cause Analysis

• The login flow actively validates credentials by calling the /users/current API endpoint through GetCurrentUserInfo.
• Robot accounts are system-level authentication tokens and are not treated as standard Harbor user principals.
• When robot accounts access the /users/current endpoint, Harbor returns a 403 Forbidden response instead of a standard user profile response.
• validateClientConnection previously handled 403 Forbidden identically to 401 Unauthorized, causing robot account authentication to fail during validation even though authentication itself succeeded successfully.

Validation Behavior Matrix

Scenario	Previous Behavior	New Behavior
Human user login	Success	Success
Invalid credentials	Failure	Failure
Standard robot account	False failure	Success
Restricted robot account	False failure	Success

What Changed

• 401 Unauthorized is now treated as the only definitive authentication failure during the primary validation step.
• 403 Forbidden responses now gracefully fall back to secondary /projects and /ping reachability validation checks instead of immediately failing the login flow.
• Restricted robot accounts without global project-listing permissions are now handled correctly by treating a 403 Forbidden response from the /projects fallback as successful validation when /ping succeeds.
• Existing authentication behavior for invalid credentials remains unchanged, and invalid credentials continue to fail immediately and securely.

Test Coverage

• Added a new table-driven mock server validation suite using httptest.NewServer.
• The test suite verifies standard human login flows returning 200 OK.
• The test suite verifies invalid credential handling returning 401 Unauthorized.
• The test suite verifies robot account validation flows returning 403 Forbidden on /users/current while successfully passing fallback validation endpoints.
• The test suite also verifies restricted robot account scenarios where /projects returns 403 Forbidden but /ping succeeds successfully.
• All scenarios pass reliably without requiring external Harbor instances or live network calls.

Fixes #941