Support managed identities to pull image bundle from remote private docker repository

**Describe the problem/challenge you have**

Currently, kapp needs a [image pull secret](https://github.com/carvel-dev/kapp-controller/blob/d3083781b202b09883d2cb7bef5b716d36575518/pkg/packageinstall/packageinstall.go#L494) to pull image bundle from remote private docker repository. However, it is not secure to use a secret to store credentials in k8s cluster.

I think passwordless is a better solution. E.g. in Azure, I would like to use [managed identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview). In this way, I don't need to handle credentials store and rotation.

**Describe the solution you'd like**

Actually there is some other project doing similar features. E.g. kpack has integrated with [ACR key chain](https://github.com/buildpacks-community/kpack/blob/main/pkg/dockercreds/k8sdockercreds/azurecredentialhelperfix/setup.go) to get docker credential on demand.

Another project is doing similar thing. [azure_credentials](https://github.com/kubernetes-sigs/cloud-provider-azure/blob/37be283a671e0ed0dfc8da61ac1043ab3d50a013/pkg/credentialprovider/azure_credentials.go#L96C23-L96C37) support GetCredentials through cloud provider interface.

**Anything else you would like to add:**

N/A

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.