wip: scope always-auth per registry

Closes #6201 by allowing each registry to have its own configuration for always-auth, so some (private) registries can have always-auth enabled, and others can wave tiny UN flags.