fix(rattler_networking): retry a digest-addressed OCI blob 404 through the manifest

[earlybard]

Description

Pull-through caches (e.g. Amazon ECR) only import an artifact once its manifest is pulled. When repodata already provides the package hash, the OCI middleware addresses the blob directly by digest and never touches the manifest — so on a pull-through cache the blob request 404s even though the artifact is available upstream.

This PR makes a digest-addressed blob 404 fall back to resolving the digest through the manifest (which triggers the cache import) and retrying the blob once. A 404 on the manifest path itself is still a real miss and comes back as a plain 404. The WWW-Authenticate challenge replay is extracted into a helper shared by both attempts, so the fallback also works when the registry re-authenticates in flight.

This is the last part of #2624, following #2628 and #2651.

Fixes #2624

How Has This Been Tested?

New integration tests against ghcr.io in oci_middleware.rs:

• a request with a bogus X-Expected-Sha256 for an existing package falls back to the manifest and still downloads the artifact (content hash verified)
• a request with a digest for a nonexistent package still returns a clean 404 instead of an error

Run with cargo nextest run -p rattler_networking oci (all 11 pass).

AI Disclosure

• This PR contains AI-generated content.
  • I have tested any AI-generated content in my PR.
  • I take responsibility for any AI-generated content in my PR.

Tools: Claude Code