[ECR] Downloading Blobs via Registry API v2 from Public ECR fails when using HEAD requests

According to the Registry API v2, the [GET Blob resource](https://distribution.github.io/distribution/spec/api/#get-blob) is defined as:
```
GET /v2//blobs/
```
The API spec also states:
> A `HEAD` request can also be issued to this endpoint to obtain resource information without receiving all data.

While ECR returns the correct blob (and HTTP 200) when issuing a `GET` request, it fails with HTTP 401 when issuing a `HEAD` request to the very same blob resource. This is not inline with the API spec and causes issues in some container management tools.

Here is a reproducible example:
```
# get a token first
TOKEN=$(curl -Ls "https://public.ecr.aws/token?service=public.ecr.aws&scope=aws" | jq -r .token)

# GET an existing blob --> succeeds with HTTP 200 (downloads 733 bytes)
curl -L -H "Authorization: Bearer $TOKEN" https://public.ecr.aws/v2/pergola/apache-artemis/blobs/sha256:4075bbc4ec0f48ded2ad33e229d3a85fd6c61f3acf35c85fd6a6ce8fd1dd44b7 -o /dev/null

# HEAD request to the same blob --> FAILs with HTTP 401
curl --head -L -H "Authorization: Bearer $TOKEN" https://public.ecr.aws/v2/pergola/apache-artemis/blobs/sha256:4075bbc4ec0f48ded2ad33e229d3a85fd6c61f3acf35c85fd6a6ce8fd1dd44b7
```

This might be related to https://github.com/distribution/distribution/issues/4383

Start by running the curl GET and HEAD commands in the issue against the referenced public ECR blob, then compare the responses with the Registry API v2 GET Blob specification and linked distribution issue. Done means an authenticated HEAD request to the same blob returns the expected successful response instead of HTTP 401.

Written by the indexing model from the issue text.