feat: Add credential helpers for Docker and pip with custom domain support

[cloudsmith-iduffy]

This PR adds credential helper infrastructure for Docker and pip package managers,
enabling automatic authentication to Cloudsmith registries without manual login
commands or embedding credentials in URLs.

This builds upon #267 (OIDC authentication) and extends the credential provider
chain to Docker and pip workflows.

• Command: cloudsmith credential-helper docker

• Binary: docker-credential-cloudsmith (for Docker CLI integration)

• Supports standard domains: docker.cloudsmith.io, *.docker.cloudsmith.io

• Supports custom vanity domains via API auto-discovery

• Auto-discovered by pip/twine via keyring.backends entry point

• Supports standard domains: python.cloudsmith.io, dl.cloudsmith.io

• Set CLOUDSMITH_ORG=my-org to enable custom domain discovery

• Fetches domains from GET /orgs/{org}/custom-domains/ API endpoint

• Caches results in ~/.cloudsmith/cache/custom_domains/ for 1 hour

• Automatic, no manual configuration needed

• Both helpers use the same credential provider chain

• Order: Environment Variable → Config File → Keyring → OIDC

• Consistent authentication behavior across all package managers

• Extensible design for future helpers (npm, cargo, maven, etc.)

• New feature

• Documentation update

• ✅ Fully backward compatible

• ✅ No breaking changes

• ✅ Existing authentication methods unchanged

• ✅ Optional features - enable by configuration

Environment setup:

$ env | grep CLOUDSMITH_
CLOUDSMITH_ORG=iduffy-demo
CLOUDSMITH_SERVICE_SLUG=default-v9ty

$ stat ~/.cloudsmith/config.ini
stat: cannot stat '/Users/iduffy/.cloudsmith/config.ini': No such file or directory

$ cloudsmith whoami --verbose
Retrieving your authentication status from the API ... OK

User: default (slug: default-v9ty)

Authentication Method: OIDC Auto-Discovery
  Source: OIDC auto-discovery: AWS (org: iduffy-demo)
  Token Slug: 6FmYSZVQrEho
  Created: 2025-06-07T19:43:47.840466Z

SSO Status: Not configured
  Keyring: Enabled (no tokens stored)

Before configuration:

$ cat ~/.docker/config.json
cat: /Users/iduffy/.docker/config.json: No such file or directory

$ docker pull docker.cloudsmith.io/iduffy-demo/default/library/ubuntu:latest
Error response from daemon: Head "https://docker.cloudsmith.io/v2/iduffy-demo/default/library/ubuntu/manifests/latest": unauthorized

After configuration:

$ cat ~/.docker/config.json
{
  "credHelpers": {
    "docker.cloudsmith.io": "cloudsmith"
  }
}

$ docker pull docker.cloudsmith.io/iduffy-demo/default/library/ubuntu:latest
latest: Pulling from iduffy-demo/default/library/ubuntu
cc43ec4c1381: Pull complete
Digest: sha256:9cbed754112939e914291337b5e554b07ad7c392491dba6daf25eef1332a22e8
Status: Downloaded newer image for docker.cloudsmith.io/iduffy-demo/default/library/ubuntu:latest
docker.cloudsmith.io/iduffy-demo/default/library/ubuntu:latest

Environment setup:

$ pip config list
:env:.default-timeout='100'
:env:.disable-pip-version-check='1'

$ python -c 'import keyring; print(keyring.backend.get_all_keyring())'
[<keyring.backends.fail.Keyring object at 0x1033a4460>, <cloudsmith_cli.credential_helpers.pip.CloudsmithKeyringBackend object at 0x1033a4c80>, <keyring.backends.chainer.ChainerBackend object at 0x1033a5360>, <keyring.backends.macOS.Keyring object at 0x1033a5720>]

Test installation (no credentials in URL):

$ pip install --no-cache-dir --index-url=https://dl.cloudsmith.io/basic/iduffy-demo/default/python/simple/ cloudsmith-python-native
Looking in indexes: https://dl.cloudsmith.io/basic/iduffy-demo/default/python/simple/
Collecting cloudsmith-python-native
  Downloading https://dl.cloudsmith.io/basic/iduffy-demo/default/python/cloudsmith_python_native-1.0.1050047-py2.py3-none-any.whl (2.2 kB)
Requirement already satisfied: toml in /Users/iduffy/projects/cloudsmith-cli/.venv/lib/python3.10/site-packages (from cloudsmith-python-native) (0.10.2)
Installing collected packages: cloudsmith-python-native
Successfully installed cloudsmith-python-native-1.0.1050047

Custom domains are discovered automatically when CLOUDSMITH_ORG is set:

1. First request fetches domains from API
2. Results cached for 1 hour in ~/.cloudsmith/cache/custom_domains/
3. Subsequent requests use cache (no repeated API calls)