Add credential manager plugin to be used by the transfer service.

Expected abilities:

• No unencrypted secrets in containerd or host configuration files
• Configurable globally or per host in hosts.toml
• Set secret from containerd plugins
• Validate credentials (i.e. login validation)
• Integrated with existing secret stores (keychain) and other credential helper plugins (i.e. Docker credential helpers)

Related to #7592