transport: validate bearer realm url

[1seal]

ref #2193

this change parses and validates the bearer realm value (scheme + host), and rejects cross-domain realm hosts before any credential-bearing token request is made. the check is bound to the registry effective domain (e.g. "registry-1.docker.io" and "auth.docker.io" are allowed).

tests included:

• rejects realm host mismatch
• rejects "http" realm for secure registries

open questions:

• should the default binding be exact host match, or effective domain match?
• should there be an explicit allowlist/option for registries that intentionally use a separate auth host?

[1seal]

hi @Subserial — this adds realm URL validation to prevent credentials from being sent to an attacker-controlled token service. minimal change, regression test included. happy to address any feedback.