Add exec-based credential support for OCI registry authentication

[dennismdejong]

Description

Adds a password_exec block to the registry configuration that allows obtaining OCI registry credentials by executing an external command. This enables OIDC/OAuth2 token-based authentication for private registries without requiring long-lived credentials.

Background

Users authenticating to OCI registries (e.g., ACR, ECR, GCR) with OIDC/OAuth2 tokens currently have no way to use short-lived credentials with the Helm provider. This adds exec-based credential support similar to what already exists for Kubernetes authentication.

Configuration

provider "helm" {
  registry {
    url      = "oci://example.azurecr.io/helm"
    username = "00000000-0000-0000-0000-000000000000"
    password_exec {
      command = "az"
      args    = ["acr", "login", "--name", "example", "--expose-token"]
    }
  }
}

Implementation

• Added password_exec nested attribute to the registry schema with command, args, and env fields
• Added executeRegistryExec function that runs the command and parses the output
• Supports JSON output parsing for common token field names (accessToken, token, access_token, status.token) with raw stdout fallback
• password field is now Optional instead of Required; either password or password_exec must be set

Fixes #1699