core: improve anon/auth token logic

[tarilabs]

while testing for #147 with ghcr.io and quay.io (so I could test the Token auth backend), I noticed the following and I believe these modification improve on the token backend logic.

I might have missed on something however 😅 , so kindly be patience and let me know if I'm not considering any gap!

Example with ghcr.io: https://github.com/users/tarilabs/packages/container/package/demo20240629-oras147 Example with quay.io: https://quay.io/repository/mmortari/demo20240629-oras147?tab=tags

To make the review hopefully easier, I've left the changes in separate commits, with richer description.

wdyt?

(note: c243eb2 introduced later as in #147 notebooks I was only testing auth backends for push and pull)