Allow users to disable builtin credential handling

[malt3]

I have a custom Bazel credential helper that can derive working Authorization headers for oci registries. In one case, this is for ghcr.io, for which rules_oci has a token realm preconfigured.
This can lead to situations where my credential helper would inject the right headers for pulling an image, but the extra requests (and command executions for docker credential helpers) fail before I get there.

I would like to have a setting (like a repo_env var) for disabling the builtin credential handling completely, since my docker config may be missing or misconfigured.

Happy to implement such a setting, but I‘d like to know if that’s something that can be merged first.