Provider/Function names from Configuration package dependencies are tied to OCI repo path

### What problem are you facing?

I previously installed providers manually (via Helm/Kustomize, applying `Provider`
manifests directly), which let me name them canonically, e.g.:

```
provider-foo
provider-kubernetes
```

With the new DevEx, Configuration packages are now the recommended way to manage
dependencies, so I've been migrating my control planes to use them. However, when a
provider is pulled in as a dependency of a Configuration, its resulting `Provider`
object is named based on the OCI repository path it was resolved from, e.g.:

```
my-registry-mirror-providers-provider-foo
my-registry-mirror-providers-provider-kubernetes
```

Since this name doesn't match the name of my existing, manually-installed
`Provider` object, the package manager doesn't recognize it as the same provider.
There's no way to rename a `Provider`/`Function` package in place, so the only path
forward is to uninstall the old provider and install the new one under the new
name. For a running production control plane, that effectively means uninstalling
the whole control plane and everything it manages, which is not something I can do
safely.

This gets worse in air-gapped/mirrored-registry setups: the OCI path used to pull a
package is often a mirror path, not the "canonical" upstream one, and that mirror
path can change independent of the package/image itself (e.g., the internal
registry gets renamed or restructured - this has already happened to me twice).
The team that owns the control plane isn't always the team that owns/names the OCI
registry, so we have no control over avoiding these renames.

Current known workarounds - installing dependencies as `apiOnly`, using
`skipDependencyResolution: true`, or manually moving CRD `ownerRefs` from the old
`Provider` to the new one while scaling the old provider to 0 - all either give up
the benefits of dependency management or carry real risk (an accidental CRD
deletion can cascade-delete managed resources).

### How could Crossplane help solve your problem?

Extend `ImageConfig` (or a similar mechanism) to let users control the resulting
package name for a dependency, decoupling the `Provider`/`Function` object's name
from the OCI repository path it happens to be resolved from.

This would let users:
- Pin a stable, canonical name for a provider/function regardless of which
registry/mirror path it's actually pulled from.
- Migrate from manually-installed providers/functions to Configuration-managed
ones without an uninstall/reinstall cycle, and without disrupting resources
already managed by those providers.
- Rename or restructure the backing OCI registry (common in air-gapped
environments) without forcing a rename/recreate of every dependent
`Provider`/`Function` object downstream.

One possible shape: an explicit `name` override per dependency in the
Configuration/Lock, or a name-rewrite rule in `ImageConfig` analogous to the
existing path-rewrite behavior used for mirrors, so a resolved image path can be
mapped to a stable, user-chosen package name.

Start by reading the existing ImageConfig path-rewrite behavior and the Configuration/Lock dependency resolution flow. Trace where Provider and Function names are derived from resolved OCI repository paths. Done should include a decided naming override mechanism that preserves stable names across mirrors and supports migration from manually installed packages.

Written by the indexing model from the issue text.