Support AWS IAM authentication for ECR image pulls

[GoldenAnpu]

Problem

The agent resolved registry credentials only from DOCKER_LOGIN / DOCKER_PASSWORD / DOCKER_REGISTRY (env vars or agent options from the instance UI). Any authentication configured on the host — e.g. the Amazon ECR credential helper used by the docker CLI — was never picked up, because pull authentication in Docker is always client-side (X-Registry-Auth header) and the agent is a separate docker-py client running inside its own container. As a result, docker pull worked on the host while the agent failed to pull the same ECR image.

Solution

All image pulls (_docker_pull, _docker_pull_progress, net-client update check) now go through a single resolver docker_utils.resolve_auth(registry, logger).

Credential resolution order

1. Explicit credentials from DOCKER_LOGIN / DOCKER_PASSWORD / DOCKER_REGISTRY (env or agent options). If the image registry is listed there, these credentials are used — existing setups keep working unchanged.
2. AWS IAM for ECR. If the registry matches an ECR hostname (<account>.dkr.ecr.<region>.amazonaws.com, incl. FIPS / China / GovCloud endpoints), the agent obtains an authorization token via boto3 using the standard AWS credential chain: EC2 instance role (IMDS), AWS_* env vars, or a mounted ~/.aws. Tokens are cached per registry and refreshed 15 minutes before expiration.
3. Docker config fallback. If neither matched, auth_config=None is passed to docker-py, which then resolves credentials from the Docker config file (~/.docker/config.json or $DOCKER_CONFIG) and credential helpers — the same way the docker CLI does. Mounting a config file into the agent container is enough for static docker login credentials.
4. Anonymous pull when nothing above yields credentials (public registries).

If the AWS token request fails (e.g. IMDS unreachable from containers — IMDSv2 hop limit must be ≥ 2), the agent logs a warning with a hint and falls through to step 3 instead of failing the pull.

Other changes

• Empty DOCKER_* values no longer produce a bogus "": {...} auth entry.
• Credentials are masked in debug logs regardless of their source (new _hide_credentials helper).
• New dependency: boto3 (imported lazily, only when the image is hosted on ECR).