[ECR] [request]: easier way to pull ECR images on Kubernetes clusters outside of AWS

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Introduce an easier way to pull ECR images on Kubernetes outside of AWS.

**Which service(s) is this request for?**
ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We run on prem Kubernetes clusters around the globe and would like to pull images from ECR. Authenticated pull requires an `ImagePullSecret` and AWS tokens are valid for 12 hours.

- Solution 1: introduce another type of token that has no expiration and provides read-only access to pull images. Provide some kind of bandwidth limit + charge for using above it. Customer creates a `Secret` and references it in their deployments.
- Solution 2: Kubernetes controller that periodically reauthenticates with AWS/ECR and refreshes the secret. But it also has to work across all namespaces.

**Are you currently working around this issue?**
[amazon-ecr-credential-helper](https://github.com/awslabs/amazon-ecr-credential-helper) but this is not a scalable solution and requires the binary file and configuration changes on every node.

**Additional context**
There are multiple projects on Github that are trying to solve this problem and I am sure the community and customers will appreciate a native solution from AWS.
https://github.com/upmc-enterprises/registry-creds
https://github.com/bzon/ecr-k8s-secret-creator
https://github.com/fermayo/ecr-k8s-secret
https://github.com/aws-containers/amazon-ecr-public-creds-helper-script-for-k8s

No repository files, tests, or entry points are named in the issue. Start by reviewing the amazon-ecr-credential-helper and linked Kubernetes secret projects, then clarify which proposed approach is wanted. Done would mean a supported way for off-AWS Kubernetes clusters to pull ECR images without manually rotating 12-hour credentials.

Written by the indexing model from the issue text.