Can not oci_pull() public images from Docker hub

[nnmm]

I've set up rules_oci-2.2.0 according to the release notes (WORKSPACE method) on Bazel 6.4.0. I have it first in my WORKSPACE file, so I think other rules should not interfere. The @distroless_base image works fine, but this one (and any other image from docker.io) does not:

# Example from https://github.com/bazel-contrib/rules_oci/blob/main/docs/static_content.md
oci_pull(
    name = "nginx_debian_slim",
    digest = "sha256:6b06964cdbbc517102ce5e0cef95152f3c6a7ef703e4057cb574539de91f72e6",
    image = "docker.io/library/nginx",
)

The error is this:

Details

WARNING: Download from https://index.docker.io/v2/library/nginx/manifests/sha256:6b06964cdbbc517102ce5e0cef95152f3c6a7ef703e4057cb574539de91f72e6 failed: class com.google.devtools.build.lib.bazel.repository.downloader.UnrecoverableHttpException GET returned 401 Unauthorized
ERROR: An error occurred during the fetch of repository 'nginx_debian_slim':
   Traceback (most recent call last):
        File "/home/user/.cache/bazel/_bazel_user/9d4d543f391defb1aa88a2e874597605/external/rules_oci/oci/private/pull.bzl", line 351, column 55, in _oci_alias_impl
                manifest, _, digest = downloader.download_manifest(rctx.attr.identifier, "mf.json")
        File "/home/user/.cache/bazel/_bazel_user/9d4d543f391defb1aa88a2e874597605/external/rules_oci/oci/private/pull.bzl", line 161, column 74, in lambda
                download_manifest = lambda identifier, output: _download_manifest(rctx, authn, identifier, output),
        File "/home/user/.cache/bazel/_bazel_user/9d4d543f391defb1aa88a2e874597605/external/rules_oci/oci/private/pull.bzl", line 152, column 13, in _download_manifest
                fail(
Error in fail: Unable to retrieve the image manifest. This could be due to
*) Authentication problems. Check if `docker pull` command succeeds with same parameters.
*) Fetching an image with OCI image media types.
*) If there is a configured URL Rewriter, check that it does not block the request.

See for more: https://github.com/bazel-contrib/rules_oci/blob/main/docs/pull.md#authentication-using-credential-helpers

I can docker pull the image just fine. I retried after docker login on my machine, same thing.

By patching rules_oci, I found out it's trying to access https://index.docker.io/v2/library/nginx/manifests/sha256:6b06964cdbbc517102ce5e0cef95152f3c6a7ef703e4057cb574539de91f72e6, which indeed returns an error when I visit in with my browser, even when I'm logged into Docker hub.

[nnmm]

Today it seems to work for some reason, I can't reproduce it anymore.