Mirror container images with proxy mirror

[pinguinfuss]

Closes #411.

proxy mirror now pre-fetches pkg:docker and pkg:oci images: index, platform manifests (with their attestations) and blobs, stored under the keys a pull reads. A later pull is served from cache even when the upstream is down.

• Manifest cache keys no longer include the client's Accept header, so Docker, containerd and Podman share one entry. The old keys are still written and read as fallback.
• proxy mirror uses the same upstream clients as serve. Before, Docker Hub answered every request with 401.
• --platform (or platforms in the API) limits multi-arch images. repository_url only resolves to configured registries.

Tested offline against Docker Hub and ghcr.io with containerd and Docker.

Open question: Docker 29 also requests sha256-<digest> tags on every pull. Offline the proxy answers those with 502 and the pull fails, on main too. Returning 404 there fixes it. Should that go in here or in its own PR?

[pinguinfuss]

@andrew For #412 I'd change MirrorImage from #438 so it always revalidates tags with a HEAD and writes the tag only after all child manifests and blobs are cached. A failed or interrupted mirror then never leaves a tag pointing at an incomplete image, and the scheduled refresh can just reuse the normal mirror run. Would you rather have that change in #438, or in a separate PR for #412 on top of it?

[andrew]

Two reproduced failures need fixing before merge:

• internal/handler/container_mirror.go:216: Mirroring updates the cached tag before fetching its layers. Starting with a fully mirrored tag, then moving that tag to an image with an unavailable layer, makes the mirror fail but leaves the tag pointing at the incomplete image. Publish the tag only after all selected manifests and blobs are cached, preserving the previous tag on failure. Please include that part of the proposed change in this PR and add a regression test.
• internal/handler/container_manifest.go:194-198: An incompatible shared entry prevents lookup of compatible per-Accept entries. Caching a Docker manifest list, then an OCI index for the same tag, then taking the upstream offline makes a Docker-only Accept request return 503 despite its cached representation still being available. Continue to the fallback keys when the shared entry is incompatible, and add a regression test.

[pinguinfuss]

@andrew Both are fixed, each with a regression test that fails without the fix.

• The mirror now resolves a tag without caching it, walks the image, and only then stores the tag. If anything fails, the previous tag stays (67fd1ad).
• When the shared entry doesn't match the client's Accept, the lookup goes on to the client's own per-Accept entry (5b9a5fc).

A second review round turned up a few more things, fixed in b0570bd:

• The tag is checked with a HEAD first, so an unchanged tag costs no GET.
• A cut-off manifest body falls back to the cached tag.
• A tag that a client pull moved while the mirror was running is kept.
• The platform filter is checked across the whole image, so a nested index without the wanted platform no longer fails it.
• A 304 for a fallback entry no longer overwrites the shared entry.

That also covers the #412 part I asked about, so #412 can reuse the normal mirror run.