FR: Use hermetic docker-credential-helpers for auth

Today, when pulling an image, rules_oci calls `docker-credential-xxx` [from a script](https://github.com/bazel-contrib/rules_oci/blob/49fbc76dacffd8f91540b66953cd264e5380aa45/oci/private/authn.bzl#L104), which requires the credential helper to be discoverable from `PATH`. Similarly, when pushing an image, rules_oci [invokes crane](https://github.com/bazel-contrib/rules_oci/blob/49fbc76dacffd8f91540b66953cd264e5380aa45/oci/private/push.sh.tpl#L50) which also requires the credential helper to be discoverable from `PATH`.

It would be nice to be able to use hermetic/managed credential helpers.

A related FR: instead of only relying on [config file](https://github.com/bazel-contrib/rules_oci/blob/49fbc76dacffd8f91540b66953cd264e5380aa45/oci/private/authn.bzl#L248), it would be nice to be able to use an env var to ship a full configuration for auth.

Start by reading the credential lookup in oci/private/authn.bzl and the push command template in oci/private/push.sh.tpl. Trace how docker-credential-xxx and crane currently depend on PATH, and review the existing config-file handling. Done means managed credential helpers can be used hermetically and a full authentication configuration can be supplied through an environment variable.

Written by the indexing model from the issue text.