feat: Support netrc-based authentication for python_repository rule

[LINKIWI]

This change introduces support for netrc and auth_patterns attributes in python_repository (and by extension, python_register_toolchains). This allows consuming projects to fetch custom Python toolchain binaries from a private/authenticated HTTP host when specified directly by URL in python_register_toolchains.

The implementation proposed here mirrors that of http_archive: https://github.com/bazelbuild/bazel/blob/1cf392ff3918386858b8c038f82c013b1e04be98/tools/build_defs/repo/http.bzl#L116

Fixes #1215.

[LINKIWI]

Thanks for the review. I colocated _get_auth in the same bzl file, but let me know if it should be placed somewhere else instead.

[aignas]

Thanks for the fixes, in general LGTM, but was wondering if the same behaviour could be achieved with using the --credential_helper feature. Have you tried it, does it work for your usecase?

[aignas]

@LINKIWI, since the PR message will be used as a commit message, could you please move everything under Test Plan to a comment on the PR as opposed to the PR description?

[LINKIWI]

Test Plan

Generated a patch based on this PR's changest and applied locally as follows:

...
http_archive(
    name = "rules_python",
    patch_args = ["-p1"],
    patches = ["//:rules_python.patch"],
    sha256 = "5868e73107a8e85d8f323806e60cad7283f34b32163ea6ff1020cf27abef6036",
    strip_prefix = "rules_python-0.25.0",
    urls = [...],
)
...

python_repository callsite:

...
load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")

py_repositories()

python_register_toolchains(
    name = "python_3_11_5",
    python_version = "3.11.5",
    tool_versions = {
        "3.11.5": {
            "url": "https://my.private.repository.com/python-3.11.5.tar.gz",
            "sha256": {
                "x86_64-unknown-linux-gnu": "fbed6f7694b2faae5d7c401a856219c945397f772eea5ca50c6eb825cbc9d1e1",
            },
            "strip_prefix": "python",
        },
    },
)
...

Verify successful fetch and build:

$ bazel build @python_3_11_5//...
INFO: Invocation ID: a9edaaf4-56b6-41e7-a956-624ec4641223
INFO: Analyzed 8 targets (1 packages loaded, 22 targets configured).
INFO: Found 8 targets...
INFO: Elapsed time: 0.672s, Critical Path: 0.00s
INFO: 3 processes: 3 internal.
INFO: Build completed successfully, 3 total actions

[LINKIWI]

I briefly looked at the new credentials helper system and I do think it would work for my use case with some user-layer (i.e. external to rules_python and Bazel) logic. I haven't experimented with it yet though since it only landed into an LTS/stable cut recently.

More generally though I think there will be a long tail of migrations to the credentials helper pattern--having netrc support in rules_python by default would be nice in the interim, for behavior parity with other OSS rulesets.