Start testing ECR authentication.

[mattmoor]

This uses github OIDC federation to impersonate an AWS role on an account owned by Chainguard, Inc. that I created for the sole purpose of testing this.

This tests both crane with the ecr-login credential helper and krane with the k8schain library.

WIP is until this uses pull_request_target

[codecov-commenter]

Codecov Report

Merging #1237 (b3a7066) into main (842ede7) will not change coverage.
The diff coverage is n/a.

❗ Current head b3a7066 differs from pull request most recent head 045eb15. Consider uploading reports for the commit 045eb15 to get more accurate results

@@           Coverage Diff           @@
##             main    #1237   +/-   ##
=======================================
  Coverage   73.77%   73.77%           
=======================================
  Files         111      111           
  Lines        8183     8183           
=======================================
  Hits         6037     6037           
  Misses       1549     1549           
  Partials      597      597           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 842ede7...045eb15. Read the comment docs.

[mattmoor]

This won't show up (yet) because it is pull_request_target, but I used a branch on the main repo and pull_request to confirm it works:

[imjasonh]

Should have caught this: aws-actions/configure-aws-credentials@v1.6.0 here and below. Dependabot should help us keep it up to date.

[mattmoor]

#1238