FR: support for AWS profiles for ecr helper

Hello!

I have a usecase for `rules_oci` to pull from a private ECR repository. One option is to have all my users define `AWS_PROFILE` env var before running Bazel, but this is awkward for the following reasons:
* Breaks the build for users that forget to set it.
* Does not work for multiple ECR registries with different profiles.

This is because in addition to the `credential_helper`, `rules_oci` also reads the default Docker credential helper configuration in https://github.com/bazel-contrib/rules_oci/blob/7de244c3cdc78fb002b1b01b2806a1dc6bd5a1aa/oci/private/authn.bzl#L116-L119

I would like to discuss if there is a way to cleanly add support for this, I would be happy to contribute a PR if we can agree on what the interface should look like. Locally I am patching this with a very naive approach:

[rules_oci_env_pull.patch](https://github.com/user-attachments/files/18642916/rules_oci_env_pull.patch) for which I then set the profile in my pull:
```py
oci.pull(
auth_env = {
"AWS_PROFILE": "my-super-secret-profile",
},
)
```

Let me know what you think!

Start with the credential-helper handling in oci/private/authn.bzl at the linked lines, then review the proposed rules_oci_env_pull.patch and the oci.pull(auth_env=...) example. Define and document an interface that supports different AWS profiles for multiple ECR registries, with the final behavior agreed before implementation.

Written by the indexing model from the issue text.