fix(sync): prime catalog auth before listing repos

[AkashKumar7902]

What

Fixes #3869.

This updates periodic sync catalog discovery so zot-to-zot sync can see repositories that require configured Basic credentials when the upstream registry also exposes some anonymous repositories.

Why

regclient does not send stored Basic credentials on the first _catalog request unless it has already received an auth challenge. With mixed anonymous/authenticated policies, zot can return 200 for unauthenticated catalog requests while filtering the catalog down to anonymous repositories, so periodic sync never discovers protected repos.

How

• Use a zot-sync User-Agent for sync-created regclient instances.
• Ping /v2/ before _catalog only when credentials are configured for the remote host, giving regclient a chance to handle the Basic auth challenge.
• Extend the mixed-policy /v2/ challenge workaround to zot-sync clients, while preserving anonymous-only behavior.
• Add focused sync and API regression coverage.

Validation

• GOEXPERIMENT=jsonv2 go test -tags "sync lint" ./pkg/extensions/sync -run TestRemoteRegistryCatalogAuth -count=1
• GOEXPERIMENT=jsonv2 go test -race -tags "sync lint" ./pkg/extensions/sync -run TestRemoteRegistryCatalogAuth -count=1
• GOEXPERIMENT=jsonv2 go test -tags "sync scrub metrics search lint userprefs mgmt imagetrust ui" ./pkg/api -run TestDockerClientV2ChallengeWorkaround -count=1
• git diff --check

GOEXPERIMENT=jsonv2 go test -tags "sync scrub metrics search lint" ./pkg/extensions/sync -run "TestRemoteRegistryCatalogAuth|TestBasicAuth" -count=1 still hits the existing missing vulnerable alpine fixture before TestBasicAuth can run: test/data/alpine/blobs/sha256/f56be85fc22e46face30e2c3de3f7fe7c15f8fd7c4e5add29d7f64b87abdaa09.