Add ECR support to Bakery registry cleanup tooling

[bschwedler]

Background

Amazon ECR Public has no native lifecycle-policy feature (confirmed via aws ecr-public help — no put-lifecycle-policy/get-lifecycle-policy, unlike private ecr; also absent
from AWS docs). The only deletion mechanism is batch-delete-image by tag or digest. Cleanup
has to be enforced client-side, the same way Bakery already handles this for GHCR
(posit_bakery/registry_management/ghcr/) and Docker Hub
(posit_bakery/registry_management/dockerhub/).

bakery clean cache-registry and bakery clean temp-registry currently document themselves
as GHCR-only:

⚠️ This command currently only supports GHCR registries. ⚠️

This issue adds ECR as a supported registry for that cleanup tooling, so any image publishing
to ECR can prune old/untagged images the same way GHCR- and Docker Hub-published images do.

Scope

• Add posit_bakery/registry_management/ecr/ with api.py (client wrapping the
  ecr-public describe-images/batch-delete-image API, following the GHCRClient/
  DockerhubClient shape), models.py (equivalent to GHCRPackageVersions, with
  older_than()/untagged() filtering), and clean.py (clean_registry() /
  clean_temporary_artifacts(), matching the GHCR/Docker Hub signatures).
• Match the existing registry-pattern convention used by GHCR (ghcr\.io/...) and Docker
  Hub (docker\.io/...) — add an ECR pattern (public\.ecr\.aws/..., and decide whether
  private ECR URIs need to be supported too).
• Wire ECR into bakery clean cache-registry and bakery clean temp-registry (remove the
  GHCR-only restriction, update command docstrings/help text).
• Reuse the existing default retention windows already used by clean_registry() for
  GHCR/Docker Hub (remove_tagged_older_than=80 weeks, remove_untagged_older_than=26 weeks) as the ECR defaults, overridable via the same CLI flags (--older-than,
  --untagged, etc.) already exposed for the other registries.
• Unit tests mirroring test/registry_management/ghcr/ and test/registry_management/ dockerhub/, plus CLI tests mirroring test/cli/test_clean.py.
• Confirm AWS auth/credentials handling needed for ecr-public API calls in CI (OIDC role
  permissions, region requirement — ecr-public API is us-east-1 only regardless of
  repository region).

Out of scope

• Determining what retention values any specific image should use — a per-image/consumer
  decision, tracked separately.
• Provisioning any ECR repository.

Related

• posit-dev/platform-team#457