`containertool` should recognise well-known registry credentials

The plugin runs `containertool` in a sandbox which limits its ability to run credential helpers, but it can still use credentials in well-known environment variables as long as the plugin passes them through to the sandbox. The same approach is [used by ko](https://ko.build/get-started/#authenticate)

For example:

* AWS: `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`
* Azure: `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET` and `AZURE_TENANT_ID`
* GitHub: `GITHUB_TOKEN`

No file or test is named. Locate the code that launches containertool and configures its sandbox, then compare the environment passthrough approach used by ko. Done means the AWS, Azure, and GitHub variables listed in the issue are available inside the sandbox, with validation or tests updated if the repository provides them.

Written by the indexing model from the issue text.