docker: drop use of external distribution challenge pkg

[flavianmissi]

in distribution v3, the registry/client package became internal. this change copies responseChallenges from upstream, removing the last reference to registry/client in this repo, making it ready for the distribution v3 bump, whenever that comes.

---

NOTE: I expected this change to cause go mod tidy && go mod vendor to remove the challenge package from the vendor dir, but that didn't happen - not sure why.

[mtrmac]

NOTE: I expected this change to cause go mod tidy && go mod vendor to remove the challenge package from the vendor dir, but that didn't happen - not sure why.

% go mod why github.com/docker/distribution/registry/client
# github.com/docker/distribution/registry/client
github.com/containers/image/v5/pkg/docker/config
github.com/containers/image/v5/pkg/docker/config.test
github.com/docker/docker/registry
github.com/docker/distribution/registry/client/auth
github.com/docker/distribution/registry/client

[mtrmac]

Thanks! distribution/distribution/v3 would be a separate Go module from docker/distribution v2.…+incompatible , so this is not immediately urgent, but removing duplicated code is always nice.

Could you restructure the code to make the handling of StatusCode more explicit, please? We don’t really need the separate responseChallenges function, and it seems somewhat non-obvious to me that a function with that name does not just parse challenges, but conditions that on a status (“A server MAY generate a WWW-Authenticate header field in other response messages” per RFC 7235)

Something like

switch {
case resp.StatusCode == http.StatusUnauthorized:
   // …
   for _, c := range parseAuthHeader(…) {
   }
   fallthrough
case resp.StatusCode >= 400 && resp.StatusCode < 500:
   …
default:
  …
}

maybe