Support Node-identity-based authentication

[ekcasey]

Use ggcr k8schain package to provide workload identity based authentication in the lifecycle. The keychain returned by NewNoClient should allow us to provide credential-helper-like authentication when the lifecycle runs in-cluster on a public cloud provider without requiring that cred-helper executables are actually installed on the image.

[natalieparellano]

Does this have implications for the work described here? https://github.com/buildpacks/lifecycle/issues/339#issuecomment-685110074

[ekcasey]

@natalieparellano Assuming we made the changes described in #339, I think we would want to add this additional keychain to the end of our MultiKeychain.

[natalieparellano]

kubelet image credential provider docs: https://kubernetes.io/docs/tasks/kubelet-credential-provider/kubelet-credential-provider/

(Edit: actually these docs expect the plugin to be installed on nodes... I'm not sure about the other case)

[natalieparellano]

Blocked on https://github.com/kubernetes/kubernetes/issues/86245

[natalieparellano]

The linked issue is still open, but we can at least add an amazonKeychain and azureKeychain to our MultiKeychain to help users of those platforms.

[natalieparellano]

Didn't mean to close this