How to authenticate with repository_ctx.download? How does auth work?

Crossposting from https://github.com/bazelbuild/bazel/issues/7469

For the last 3 years people have been wanting to know how to achieve this. The only person who did is sitting duck and not telling anybody.

We owe this state of affair to the lackluster documentation: https://bazel.build/rules/lib/builtins/repository_ctx
```
auth [dict](https://bazel.build/rules/lib/core/dict.html); default is {}
An optional dict specifying authentication information for some of the URLs.
```

As such I would like to ask on behalf of everyone who asked so far, to please update the documentation in that regard.

Start with the repository_ctx.download documentation at bazel.build/rules/lib/builtins/repository_ctx and determine the supported structure and behavior of its auth dictionary. Document how authentication works for download URLs, including a concrete usage example once the behavior is verified. Done means users can understand and apply auth without relying on undocumented guidance.

Written by the indexing model from the issue text.