OCI imports do not refresh expired registry tokens #1542

Problem

#1480 (for #1479) adds the anonymous Bearer token flow for OCI imports. _RegistryTokens caches one token per challenge for a whole import resolution (raes/module_registry/_registry_auth.py:188-197 at head 7dd887f8), and _registry_get (:208-235) sends each request anonymously and answers a 401 challenge with one retry carrying the cached token. Nothing reads the token's expires_in or requests a new token. If the cached token has expired, the retry gets 401 and the whole resolution fails with SDLParseError.

Docker Hub's anonymous tokens expire after 300 s. A resolution that runs longer than that, for example a large bundle layer on a slow link followed by another request, fails partway. The #1480 body records this: "Tokens are not refreshed; Docker Hub's expire after 300 s."

Scope

• When a token-bearing retry gets a 401 challenge, request a fresh token once and retry once more, or refresh before use from expires_in.
• Keep the current guarantees: no Authorization header on redirected requests, and a bounded number of token requests per resolution.

Done when

• A test in which the registry rejects the cached token after the first requests resolves the import with one new token.
• A registry that keeps rejecting fresh tokens still fails with SDLParseError after a bounded number of attempts.
• Redirected requests still carry no Authorization header.

Related

• fix(sdl): fetch oci modules from public registries through the anonymous token flow #1480 (noted it), fix(sdl): fetch oci modules from public registries through the anonymous token flow #1479