feat: add support for GAR image-pull auth via GCP identity

[PeteE]

Summary

• Adds an optional ImagePullAuthAugmenter provider interface (src/cloud-providers/types.go) that lets a cloud provider contribute registry credentials derived from its own cloud identity, merged into the auth.json shipped to the podvm alongside any operator-supplied imagePullSecrets.
• Implements it for GCP (src/cloud-providers/gcp/imagepullauth.go): mints a short-lived OAuth token (via ADC or an impersonated service account) scoped for Artifact Registry / GCR (us-central1-docker.pkg.dev-style hosts), so podvm image pulls from GAR can authenticate using CAA's own GKE Workload Identity instead of requiring an imagePullSecret.
• Wires the new config into GCP's provider: GCP_PULL_REGISTRY (registry hostname to authenticate against) and GCP_PULL_IMPERSONATE (optional least-privilege SA to impersonate when minting the token), with ConfigVerifier validation to fail fast on misconfiguration (impersonation set without a registry, or a registry value that isn't a bare hostname).
• Adds mergeDockerAuths in pkg/adaptor/cloud/cloud.go to combine the operator's imagePullSecrets-derived auth.json with the provider-derived auth (provider auth wins on host conflicts); augmentation failures are non-fatal and fall back to the existing behavior.

Test plan

• go build ./... / existing unit tests pass
• Deploy CAA to GKE with GCP_PULL_REGISTRY set to a GAR host and verify podvm image pulls succeed without an imagePullSecret
• Verify GCP_PULL_IMPERSONATE path mints a token scoped to the impersonated SA
• Verify ConfigVerifier rejects GCP_PULL_IMPERSONATE without GCP_PULL_REGISTRY, and rejects a GCP_PULL_REGISTRY containing / or @