We might want in the future to "blacklist" some specific docker versions, or more simply to refuse push from too-old / unsupported anymore clients.

See #570 for why I want a provision for these cases beforehand.

That means we have a documented way on the registry that clients can honor to back-of.

Although UA sniffing is considered bad practice in the wider-web, it may be the simplest path - but maybe there are other ways to "identify" a problematic client.

As for the response, 412 + informative message?