feat: add timeout attribute to container_pull

The PULLER_TIMEOUT env variable is convenient, but one very large image shouldn't require that all of them have timeouts changed.

container/pull.bzl

@@ -22,7 +22,7 @@ construct new images.
 NOTE: `container_pull` now supports authentication using custom docker client configuration.
 See [here](https://github.com/bazelbuild/rules_docker#container_pull-custom-client-configuration) for details.
 
-NOTE: Set `PULLER_TIMEOUT` env variable to change the default 600s timeout.
+NOTE: Set `PULLER_TIMEOUT` env variable to change the default 600s timeout for all container_pull targets.
 
 NOTE: Set `DOCKER_REPO_CACHE` env variable to make the container puller cache downloaded layers at the directory specified as a value to this env variable.
 The caching feature hasn't been thoroughly tested and may be thread unsafe.
@@ -123,6 +123,11 @@ _container_pull_attrs = {
         Note: For reproducible builds, use of `digest` is recommended.
         """,
     ),
+    "timeout": attr.int(
+        doc = """Timeout in seconds to fetch the image from the registry.
+
+        If specified, this overrides the value from the PULLER_TIMEOUT environment variable.""",
+    ),
 }
 
 def _impl(repository_ctx):
@@ -200,7 +205,10 @@ def _impl(repository_ctx):
 
     kwargs = {}
 
-    if "PULLER_TIMEOUT" in repository_ctx.os.environ:
+    if repository_ctx.attr.timeout > 0:
+        args.extend(["-timeout", str(repository_ctx.attr.timeout)])
+        kwargs["timeout"] = repository_ctx.attr.timeout
+    elif "PULLER_TIMEOUT" in repository_ctx.os.environ:
         timeout_in_secs = repository_ctx.os.environ["PULLER_TIMEOUT"]
         if timeout_in_secs.isdigit():
             args += [