ociauth: captures stderr from credential helpers

[tianon]

It's common/normal for Docker credential helper binaries to use stderr as a side channel for debugging, warnings, notices, etc, so capturing both stdout and stderr into the same stream and trying to parse them both together as JSON leads to errors like cannot acquire auth info for registry "foo.example.com": invalid character 'X' looking for beginning of value (for helpers that work fine with Docker itself and with other tools).

oci/ociregistry/ociauth/authfile.go

Lines 373 to 374 in 57ddb82

	cmd.Stdout = &out
	cmd.Stderr = &out

I guess this should be captured into a separate stream? or should just go straight to os.Stderr but maybe there are use cases for this library where that wouldn't be appropriate?

Also relevant, just above that: 😂

oci/ociregistry/ociauth/authfile.go

Lines 370 to 371 in 57ddb82

	// TODO this doesn't produce a decent error message for
	// other helpers such as gcloud that print errors to stderr.