WIP: Fallback to running system's auth.json

[ckyrouac]

This fixes a bug where running bootc upgrade/switch to an image that does not have an auth.json results in failing to pull new LBIs that are stored in an authenticated registry.

This also adds a test for this to the existing LBI switch TMT test. It does this by using cstor-dist as an authenticated registry, running on the TMT test VM. Marking as a WIP for now until I push the cstor-dist image somewhere permanent.

[gemini-code-assist]

Code Review

This pull request introduces a fallback mechanism to use the host's auth.json when pulling images if the target image for an upgrade or switch doesn't contain one. This is a valuable fix for scenarios involving authenticated registries. The core logic change in Rust is sound, and I've offered a minor suggestion to improve its conciseness. The accompanying tests are thorough, effectively validating the new fallback behavior using a local authenticated registry. I've provided a couple of suggestions for the test scripts to enhance maintainability by reducing code duplication.

[gemini-code-assist]

This if let ... else if let ... chain can be simplified by combining the fallback logic into a single else block, which makes the code slightly more concise.

Suggested change

	let authfile = if let Some((path, file)) = ostree_ext::globals::get_global_authfile(sysroot)? {
	tracing::debug!("Using authfile from sysroot: {path}");
	Some(file)
	} else if let Some((path, file)) = get_host_authfile()? {
	tracing::debug!("Using authfile from host root: {path}");
	Some(file)
	} else {
	None
	};
	let authfile = if let Some((path, file)) = ostree_ext::globals::get_global_authfile(sysroot)? {
	tracing::debug!("Using authfile from sysroot: {path}");
	Some(file)
	} else {
	get_host_authfile()?.map(|(path, file)| {
	tracing::debug!("Using authfile from host root: {path}");
	file
	})
	};

[gemini-code-assist]

To improve readability and reduce repetition, you can define more_images by appending to the existing $images list, which is defined just a few lines above. This approach is more concise and consistent with how this variable was constructed before this change.

    let more_images = $images | append [
        { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.3", "name": "ubi-minimal-9-3" },
        { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/busybox:latest", "name": "cstor-busybox" }
    ]

[gemini-code-assist]

This list of images is identical to the more_images list defined in second_boot. To avoid this duplication and improve maintainability, consider extracting this list into a shared helper function or constant that can be used in both places.

For example, you could add a helper function:

def get_final_images [] {
    [
        { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.4", "name": "ubi-minimal" },
        { "bound": true, "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.3", "name": "ubi-minimal-9-3" },
        { "bound": false, "image": "quay.io/centos-bootc/centos-bootc:stream9", "name": "centos-bootc" },
        { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/alpine:latest", "name": "cstor-alpine" },
        { "bound": true, "image": $"($CSTOR_DIST_REGISTRY)/docker.io/library/busybox:latest", "name": "cstor-busybox" }
    ]
}

Then you could use let more_images = get_final_images in second_boot and let images = get_final_images here.