find auth for shrinkwrapped deps (fixes #7011)

This is a tiny bit hacky, but for private registries using scopes and
tarball auth, it will ensure that the bearer token / basic auth
credentials are passed for tarball dependencies when all the credentials
are properly configured. See the test for details of how the
configuration should look.
fixed typo
spacing issue