FR: Use the .netrc for authentication information when pulling images

[shs96c]

The Bazel downloader is configured to use the user's .netrc by default. When looking for credentials when pulling an image, it would be nice if rules_oci also used information from the .netrc too. This would allow people to download content from a docker server that requires authentication without also needing the docker CLI tools to be present on their machine, and it would provide a consistent mental model for people about how authentication when downloading with Bazel should work.

[shs96c]

This would also provide a mechanism for users to avoid needing to patch the _WWW constant in authn.bzl for privately hosted docker servers.

[thesayyn]

.netrc should be working already as we use rctx.download for fetching the images, the _WWW constant is something we have to do perform the exchange.

[shs96c]

I'll need to check, but I've certainly tried to pull from a docker repo that needed authentication and found that only worked once I'd added the credentials to my osxkeychain.