feat: add OCI multi-registry support (ghcr.io, quay.io, mcr.microsoft.com, etc.)

[EpicTGuy]

Summary

The script was previously hardcoded for Docker Hub only. This PR adds support for any OCI Distribution Spec compliant registry by dynamically discovering the auth endpoint via the WWW-Authenticate header returned on a 401 response.

Tested against: docker.io, ghcr.io, quay.io, registry.gitlab.com, mcr.microsoft.com.

Changes

Script

• Registry detection: if the first path component of the image spec contains a dot (e.g. ghcr.io/user/image), it is treated as a registry hostname
• Dynamic auth discovery: probe GET /v2/ to capture the WWW-Authenticate header, then parse realm and service to build the token URL
• No-auth registries: if /v2/ returns 200 with no WWW-Authenticate (e.g. mcr.microsoft.com), proceed without a token
• Multi-arch index support: handle both application/vnd.oci.image.index.v1+json and application/vnd.docker.distribution.manifest.list.v2+json for platform resolution
• Docker Hub backward compat: the original flow (via hub.docker.com API + auth.docker.io) is fully preserved

README

• Document OCI registry support and how auth discovery works
• Update examples to include a GHCR pull

Implementation notes

• Use GET instead of HEAD for the /v2/ probe — some registries (e.g. ghcr.io) return 405 on HEAD
• Use tr -d '"[:space:]"' before parsing the manifest list JSON — registries may return pretty-printed JSON; spaces break the grep/sed pipeline (safe because OCI manifest list string values never contain spaces)
• Take only head -1 from extract '"mediaType"' to avoid matching nested entries in the manifests array

Test results

Registry	Image	Result
docker.io	hello-world:latest	PASS
docker.io	alpine:3.18	PASS
ghcr.io	toeverything/affine:stable	PASS (48 794 files)
ghcr.io	toeverything/affine:sha256:44c65e...	PASS (digest ref)
quay.io	prometheus/prometheus:latest	PASS
registry.gitlab.com	gitlab-org/gitlab-runner:latest	PASS
mcr.microsoft.com	hello-world	PASS