Plumb through the notion of build-time repositories.

[mattmoor]

There are three interesting use cases enabled by this change:

1. Silence ./packages warnings with our private images.

Currently for our private images, we pull private packages via GCS fuse mounted to ./packages/. This results in warnings from apk when the indices are updated today because this path does not exist.

By making ./packages a build-time only thing, this goes away.

2. Stop leaking auth in build repository URLs into the final image

Currently it is impossible to use https://user:pass@repo style repositories without the credential leaking into the image's /etc/apk/repositories.

With this change, credentialed URLs may be passed to --build-repository-append and the credentials will only be used for the initial image construction and not be present in the final image.

3. Enable using private APK registries with HTTP_AUTH without breaking apk update

We uncovered an unfortunate side-effect of switching from ./packages to apk.cgr.dev/chainguard-private for our packages: apk update breaks.

With the former, we get a WARNING that ./packages is not found (see 1. above).

With the latter, we get a WARNING that the caller isn't authorized, but unlike ./packages it returns a non-zero exit code breaking Dockerfile builds.

Armed with this change, we can move apk.cgr.dev/chainguard-private into our build_repositories, specify auth at build-time via HTTP_AUTH and avoid the private repository URL leaking into the final image causing apk update to break.