ggcr: k8schain not using AWS IRSA credentials for ECR auth

[haarchri]

Describe the bug

A clear and concise description of what the bug is.
in crossplane project we using ggcr to fetch xpkg packages from registries - it looks like that the AWS IRSA credentials for ECR auth not working anymore - any ideas to debug this ?

failed to fetch package digest from remote: failed to fetch package descriptor with a GET request after a previous HEAD request failure: HEAD https://123456789101.dkr.ecr.eu-central-1.amazonaws.com/v2/xxx-crossplane/sop-tenant/manifests/v1.427.0: unexpected status code 401 Unauthorized (HEAD responses have no body, use GET for details): GET https://123456789101.dkr.ecr.eu-central-1.amazonaws.com/v2/xxx-crossplane/sop-tenant/manifests/v1.427.0: unexpected status code 401 Unauthorized: Not Authorized

https://github.com/crossplane/crossplane/blob/master/internal/xpkg/fetch.go#L149-L175

the ServiceAccount is annotated with the EKS Annotation for IRSA - we tested with AWS-CLI inside the container - aws sts get-caller-identity is working

is it possible to get more debug for the auth key-chain ?

To Reproduce

Expected behavior

A clear and concise description of what you expected to happen.

Additional context

Add any other context about the problem here.

• Version of the module
• Registry used (e.g., GCR, ECR, Quay)