[Public ECR] [request]: Don't check for login token when pulling from public repos

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

[Don't check for | allow all] login tokens when pulling from public ECR

**Which service(s) is this request for?**

Public ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

If I've ever pushed a docker image to public ECR, I now have to login to be able to pull it again, or any other image. This affects both my own images and foreign images from other accounts

This is annoying when I'm doing a `docker build . --pull` (part of our makefile) as it forces a pull to ensure it has the latest image, and that pull is blocked if I'm not freshly logged-in to public ECR.

**Example:**

I have previously pushed an image to my own repo, which required 'logging in' using a valid STS token, so I now have an entry in my `.docker/config.json` file for `public.ecr.aws`. When it's not up to date (12 hours) it blocks pulls from both my repo and foreign public repos:
```
$ docker pull public.ecr.aws/MYHASH/MYAPP:latest
Error response from daemon: pull access denied for public.ecr.aws/MYHASH/MYAPP, repository does not exist or may require 'docker login': denied: Your authorization token has expired. Reauthenticate and try again.

$ docker pull public.ecr.aws/cloudwatch-agent/cloudwatch-agent:latest # have tried to pull previously as a test
Error response from daemon: pull access denied for public.ecr.aws/cloudwatch-agent/cloudwatch-agent, repository does not exist or may require 'docker login': denied: Your authorization token has expired. Reauthenticate and try again.

$ docker pull public.ecr.aws/nginx/nginx:latest # have never tried to pull previously
Error response from daemon: pull access denied for public.ecr.aws/nginx/nginx, repository does not exist or may require 'docker login': denied: Your authorization token has expired. Reauthenticate and try again.
```

Note that the keys in the docker login cfg don't include a hash to specify a sub-registry, it looks like thre's just one global entry for public ECR

```
$ jq ".[] | keys[]" < .docker/config.json | grep public
"public.ecr.aws" # ie: not public.ecr.aws/MYHASH
```

If I then log into my repo using the non-memorable login command supplied for that repo...

```
$ aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/MYHASH
WARNING! Your password will be stored unencrypted in /home/paul/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
```

... now I can pull foreign images (as well as my own, of course)
```
$ docker pull public.ecr.aws/nginx/nginx:latest
latest: Pulling from nginx/nginx
45b42c59be33: Already exists
8acc495f1d91: Pull complete
-- snip --
```

There doesn't seem to be any real reason to block the pulling of public images, and merely having this login entry saved in my `.docker/config.json` means I am less able to pull public images than someone who has never logged in to push images.

**Are you currently working around this issue?**
AWS Support has suggested a cronjob to re-login to the public ecr repo every 11 hours+login, to keep the token fresh

The issue concerns Public ECR pulls through Docker and names the aws ecr-public login flow, public.ecr.aws, and .docker/config.json; start by reproducing the expired-token behavior with the documented docker pull commands. Done means public images remain pullable when an expired Public ECR login entry is present, without requiring the suggested cronjob re-login workaround.

Written by the indexing model from the issue text.