I am still trying to figure out how to restrict the access to content-app for anonymous users. Checking the basic auth header is not enough.

Actually, we do not need to restrict the access to content-app. Similarly, we do not pass a token to content-app and check the access scope. Everything is tested inside api-app. So, I am making this PR ready for review.

When I was testing this change, I was receiving errors like: "Repository not found", but the remote repository was available. Then, I realized the error was because of the lack of authentication.
What if we return 401 for
https://github.com/pulp/pulp_container/pull/1659/files#diff-1b944e15118f82233aa03a435e9e05c188ad0d371b71be43260506b4a5eeddffR315 (not self.request.user.is_authenticated)
https://github.com/pulp/pulp_container/pull/1659/files#diff-1b944e15118f82233aa03a435e9e05c188ad0d371b71be43260506b4a5eeddffR1046 (not permission_checker.has_pull_through_permissions(distribution))
https://github.com/pulp/pulp_container/pull/1659/files#diff-1b944e15118f82233aa03a435e9e05c188ad0d371b71be43260506b4a5eeddffR1101 (not permission_checker.has_pull_through_permissions(distribution))
?

for example:

    if (
        distribution.remote
        and distribution.pull_through_distribution_id
        and request.user.is_authenticated
    ):
        <logic block>
    elif not request.user.is_authenticated:
        raise UnauthorizedException()
    else:
        raise ManifestNotFound(reference=pk)

Trying to pull from a private pull-through distribution, it returned:

requested access to the resource is denied

instead of "repository not found".

The idea is to not change the default behaviour. Once there is no such a repository existing in Pulp, we should return 404 in case an unauthorized user is trying to pull it. If the repository exists, and it is private, we should return 401 when the unauthorized user is accessing it. This whole workflow should be transparent to pull-through caching. I think more granular error handling is not needed in this case.