Extend dynamic authentication discovery across nv-boot registry clients

Description

Most registry clients in nv-boot-starter-registries authenticate against fixed,
per-registry token endpoints with duplicated per-client auth logic. This issue tracks
future improvements to generalize dynamic authentication discovery across the module.
Implementation details are TBD and will be refined per client before each piece of work
starts.

Planned scope, in rough order:

1. Move the NGC artifact registry client off its legacy path and onto the OCI distribution
   spec flow (TBD; needs more information from NGC on the supported artifact API).
2. Refactor the oci package to provide dynamic authentication discovery as the shared
   implementation.
3. Refactor the ngc, acr, artifactory, docker, and harbor clients to use the new oci
   package.
4. ecr and volcengine clients: TBD

Definition of Done

• Challenge discovery lives in the oci package and is reused by clients instead of
  being duplicated per client.
• The NGC artifact registry client no longer depends on the legacy endpoint.
• Existing registry suites keep passing; migrated behavior is covered by tests.

Resources

• Relates to #556

By submitting this issue, you acknowledge that you are an assigned member of the NVCF development team and agree to follow our code of conduct and our contributing guidelines.

Start by reviewing the oci, ngc, acr, artifactory, docker, harbor, ecr, and volcengine packages, along with related issue #556. Clarify the per-client migration scope and the supported NGC artifact API before implementation. Done means challenge discovery is shared through oci, the legacy NGC endpoint is removed, and registry suites plus migration tests pass.