GCE_METADATA_HOST not passed through to credential-helper

When using `docker-credential-gcr` with regular docker, setting the [`GCE_METADATA_HOST`](https://googleapis.dev/python/google-auth/latest/reference/google.auth.environment_vars.html#google.auth.environment_vars.GCE_METADATA_HOST) environment variable tells it to use the given endpoint instead of the default one to fetch tokens via [ADC](https://cloud.google.com/docs/authentication/provide-credentials-adc).

This does not work with `rules_oci` since the environment variable is not passed on to the credential helper process.

I believe the trivial fix would be to just add it to this list:
https://github.com/bazel-contrib/rules_oci/blob/a195e365/oci/private/authn.bzl#L369

Is that correct? Would it be acceptable to add it there? If yes, I'm happy to create a PR for it.
If that use-case is too specific and you'd rather not add the env to the list, is there any other way to expose the correct settings, i.e. make the list of pass-thru-envs dynamic?

Inspect the environment pass-through list in oci/private/authn.bzl around line 369, then trace how it is supplied to the credential-helper process. Confirm that GCE_METADATA_HOST reaches that process and that the helper can use the configured endpoint; the issue does not name a test to run.

Written by the indexing model from the issue text.