feat(docker): auto-resolve registry auth from ~/.docker/config.json

[jarlah]

Summary

• Adds Testcontainers.Docker.Auth.resolve/2, which reads ~/.docker/config.json (respecting DOCKER_CONFIG), looks up credentials for the target image's registry, and returns a ready-to-send X-Registry-Auth header value (URL-safe base64 of JSON with username, password, serveraddress, per the Docker Engine API spec).
• Wires auto-resolution into Testcontainers.maybe_pull_image/2 via a pull_with_fallback/2 helper: when Container.auth is not set, auto-resolution is attempted; explicit Container.auth still takes precedence.
• serveraddress is normalized to a bare host (scheme and trailing path stripped; index.docker.io canonicalized to docker.io). This matches the Docker Engine API spec and fixes a 400 from podman, which rejects full-URL serveraddress values.
• If auto-resolved credentials cause the pull to fail with an HTTP 4xx, the pull is retried once without the header. Stale or unrelated entries in ~/.docker/config.json (common on shared CI runners) therefore can't break pulls that would otherwise succeed anonymously. Explicit Container.auth is never retried — failures there stay failures.
• Missing / invalid config files are handled silently at debug level so this feature never breaks existing pull flows.
• Scope: auths entries only. credsStore / credHelpers are intentionally out of scope for this PR — if encountered we log at debug level and fall back to anonymous, rather than shelling out to a helper binary. Support for those can be added in a follow-up.

Fixes #182

Test plan

• mix compile
• mix credo --strict
• mix dialyzer
• mix test — 205 tests, 0 failures
• test/docker/auth_test.exs covers:
  • Docker Hub image resolves to the docker.io entry with a scheme-free, path-free serveraddress (regression test)
  • Private-registry image resolves to the matching host entry
  • Unknown registry / missing file / invalid JSON all return nil
  • Header is URL-safe base64 without padding (matches Docker Engine API spec)
  • normalize_server_address/1 strips schemes and paths, canonicalizes index.docker.io → docker.io
• Manual smoke test against a real private registry (not covered by automated tests to avoid requiring live credentials).