Treat the service parameter as optional in Bearer auth challenges

[Syed-Umair]

What

createTokenRequest rejects any WWW-Authenticate: Bearer challenge that omits service, so logging in to a registry that does not send it fails with:

cannot parse service from WWW-Authenticate header

Google Artifact Registry is one such registry. Its challenge carries only a realm:

www-authenticate: Bearer realm="https://us-central1-docker.pkg.dev/v2/token"

This makes container registry login (and therefore container image push/pull) unusable against Artifact Registry.

Why this is the right fix

service is a convention of the Docker registry token spec, not a requirement of RFC 6750 §3, so a conforming registry may omit it.

parseWWWAuthenticateHeaders already models service as optional, and AuthChallengeTests has a case for a challenge without it. Only createTokenRequest treated it as mandatory, so the parser and its one caller disagreed. This change makes the caller match the parser.

realm stays mandatory — without it there is nowhere to send the token request.

Change

• TokenRequest.service becomes String?.
• fetchToken appends the service query item only when the challenge supplied one.
• createTokenRequest passes the optional through instead of rejecting nil.

A challenge that does carry service produces an identical request to before, so Docker Hub and GHCR are unaffected.

Verification

Artifact Registry issues a token when service is omitted:

$ curl -G https://us-central1-docker.pkg.dev/v2/token \
    --data-urlencode 'client_id=containerization-registry-client' \
    --data-urlencode 'scope=repository:PROJECT/REPO/IMAGE:pull,push' \
    -H 'Authorization: Basic <oauth2accesstoken:...>'
HTTP 200   {"token": "...", "expires_in": ...}

With container built against this change, against a real Artifact Registry repository:

$ container registry login -u oauth2accesstoken --password-stdin us-central1-docker.pkg.dev
Login succeeded
$ container image push us-central1-docker.pkg.dev/PROJECT/REPO/IMAGE:latest
... 100% (14 blobs, 73.0 MB)

Both fail on 1.3.1 with the error above. Pushes to Docker Hub still work.

Tests/ContainerizationOCITests/TokenRequestServiceTests.swift adds coverage for the service-less challenge, the service-present case, and the still-rejected missing realm. It compiles, but I could not execute the suite locally — swift test needs Testing.framework from a full Xcode install and every test target fails to load without it, so CI results are the ones to trust here.