[Request]: support container registries with separate authentication domains

### Feature or enhancement request details

When logging in to a registry where the authentication server lives on a different domain than the registry itself (e.g. Scaleway's `rg.fr-par.scw.cloud` -> `api.scaleway.com`), the login command fails with:

```
container registry login rg.fr-par.scw.cloud/namespace -u nologin --password-stdin <<< "$SCW_SECRET_KEY"

Error: refusing insecure credential exchange: authorization server api.scaleway.com is not in the same registrable domain as registry rg.fr-par.scw.cloud
```

Both these domains are valid and expected but Scaleway have chosen to host their authentication service on a different root domain (`scaleway.com`) to their container registry service (`scw.cloud`).

It would be great if there was a flag or some sort of allowlist that could be used to indicate that the miss-match in registry & auth domains is expected.

I think the logic that handles the validation of hostnames might actually be in https://github.com/apple/containerization so not sure if you'd prefer the issue created there instead but I figure as it's the `login` command I'd like to see extended to let the user allow this behaviour it makes sense to start here.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start with the container registry login command and trace the hostname validation that rejects api.scaleway.com for rg.fr-par.scw.cloud. Check whether that logic belongs in this repository or apple/containerization. Done should provide an explicit way to allow an expected registry/authentication-domain mismatch while retaining refusal for unapproved domains.

Written by the indexing model from the issue text.