support basic_auth at the provider level

[imjasonh]

This is intended to be used with something like https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token to provide ko-provider-wide auth for all requests.

As an example I haven't yet tried myself, to authorize pushes to an ECR repo:

data "aws_ecr_authorization_token" "token" {}

resource "aws_ecr_repository" "foo" {
  name = "foo"
}

provider "ko" {
  docker_repo = aws_ecr_repository.foo.name
  basic_auth = aws_ecr_authorization_token.token.authorization_token
}

Help with #37

[imjasonh]

The ko_resolve resource doesn't work with this yet, because it uses commands.NewPublisher, which always uses the credhelper-infused multikeychain, and doesn't provide a way to override that. We might need to crack open stuff in ko to enable that, or use something besides pkg/commands.

[mattmoor]

We'll need to reconcile this with your other change.

[mattmoor]

LGTM other than coordinating the keychain PRs