feat(config): Deprecate & warn on bare _auth & _authToken

[darcyclarke]

Summary

Show deprecation warning when these configs are set. The reason behind this was to remove all auth that wasn't scoped to a specific registry (this would increase the safety/security of setting/handling this type of config).

Exit Criteria

• Discuss with @nlf before moving forward
• Add deprecation warnings for _auth config
• Add deprecation warnings for _authToken config
• Add deprecation warnings for username config
• Add deprecation warnings for password config
• Add deprecation warnings for email config email is currently moved to the top level, let's leave this one alone until we can deal with the separation of login/adduser where that config is consumed

[nlf]

i'm trying to recall where we were headed with this thought. in doing some thinking just now without having that context, i feel pretty strongly like we should remove all forms of authentication that are not scoped to a specific registry. right now we'll allow a bare _authToken if the registry the request is going to is your default registry, but even that feels a bit wrong since it's trivial to change the registry for one specific command and inadvertently sending your token to a registry you did not expect to send it to.