bug(vex): Trivy doesn't support auth for OCI images from private registries

[DmitriyLewen]

Description

When trying to get VEX documents from the OCI image we get an authentication error:

failed to probe the package URL:
github.com/aquasecurity/trivy/pkg/vex.RetrieveVEXAttestation
/home/runner/work/trivy/trivy/pkg/vex/oci.go:42
fetching documents: looking for documents: resolving image reference: GET https://xxx.azurecr.io/oauth2/token?scope=repository%3Aaaa-bbb%3Apull&service=xxx.azurecr.io: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information. CorrelationId: xxxx-xxx-xx-xx-xxxxx

Unfortunately, github.com/openvex/discovery doesn't support auth.
I created openvex/discovery#82 about adding remote options for ProbePurl.

Discussed in #8911

[DmitriyLewen]

Workaround:
you can use trivy registry login/docker login to avoid this error and get VEX file from private registry:

➜  TRIVY_USERNAME=dmitriylewen TRIVY_PASSWORD=xxx trivy -q image dmitriylewen/8916 --vex oci
2025-06-03T15:34:47+06:00       FATAL   Fatal error     run error: filter error: filtering error: VEX error: VEX error: VEX OCI error: failed to retrieve VEX attestation: failed to probe the package URL: fetching documents: looking for documents: resolving image reference: GET https://index.docker.io/v2/dmitriylewen/8916/manifests/sha256:4a2047b0e69af48c94821afb84ded71dee018059ac708e0e8f3e687e22726cd2: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:dmitriylewen/8916 Type:repository]]
➜ trivy registry login index.docker.io --username dmitriylewen --password xxx
2025-06-03T15:36:44+06:00       INFO    Login succeeded file_path="/Users/dmitriy/.docker/config.json" username="dmitriylewen"
➜ trivy -q image dmitriylewen/8916 --vex oci             

Report Summary

┌───────────────────────────────────┬────────┬─────────────────┬─────────┐
│              Target               │  Type  │ Vulnerabilities │ Secrets │
├───────────────────────────────────┼────────┼─────────────────┼─────────┤
│ dmitriylewen/8916 (alpine 3.22.0) │ alpine │        0        │    -    │
└───────────────────────────────────┴────────┴─────────────────┴─────────┘

cc. @tomlissen

[tomlissen]

thnx! seems to work :)