Add ECR as a first-class source

I would like to use a docker image for my build pipelines, but unfortunately I have no way of automating authentication in the pipeline prior the the container being downloaded.

The 12 hour key restriction for ECR makes it basically impossible to use containers from ECR for my builds.

Start by locating the build-pipeline container source and authentication entry points, then trace when credentials are obtained relative to the container download. Review the ECR 12-hour key restriction and define how an ECR source should authenticate automatically. Done means ECR images can be used in build pipelines without manual authentication before download.

Written by the indexing model from the issue text.