…als v0.0.12 compat) (#2603)

## Summary

- `credentials v0.0.12` unified the `Resolver` interface to a single
`Resolve(ctx, identity) (runtime.Typed, error)` method, removing the
separate `ResolveTyped` method that existed in v0.0.11
- `constructor v0.0.8` (released as part of gate 4, PR #2598) still
calls `provider.ResolveTyped` and depends on `credentials v0.0.11`
- This causes a build failure when any module depends on both
`constructor v0.0.8` and `credentials v0.0.12`

This fix updates `construct.go` to call `provider.Resolve` and bumps the
credentials dependency to `v0.0.12`.

## Dependency on
Must be released as `constructor/v0.0.9` before PR #2602 (gate 5 plugin
migration) can drop its `replace` directive.

Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

…credentials (gate 5) (#2602)

## Summary

Gate 5 of the typed credentials migration (#1047). Migrates `plugin`,
`constructor`, and `input/*` modules from `map[string]string` to
`runtime.Typed` credentials.

This continues the series started in gates 1-4 (blob, signing, rsa,
repository, sigstore, oci, constructor published as PR #2598).

### Modules changed

| Module | Change |
|--------|--------|
| `bindings/go/constructor` | `Resolver.Resolve` return type
`map[string]string` → `runtime.Typed`; bump credentials v0.0.11→v0.0.12
|
| `bindings/go/input/dir` | `ProcessResource`/`ProcessSource`
credentials param `map[string]string` → `runtime.Typed` |
| `bindings/go/input/file` | same |
| `bindings/go/input/utf8` | same |
| `bindings/go/plugin` | All contract interfaces, registry
implementations, handlers, converters, test plugins |

### Key design decisions

- **Client side** (`toCredentials`): `nil` credentials → sends `"{}"`
JSON to preserve valid Authorization header format
- **Server side** (handlers): deserialize Authorization header into
`&runtime.Raw{}` since concrete type is unknown at HTTP boundary
- **`plugin/go.mod`**: uses `replace` directive pointing to local
`../constructor` (gate 5 constructor not yet released as module tag)

### Related issues
- Part of #1047 (typed credentials migration)
- Supersedes draft PR #2599

## Test plan

- [x] `go build ./...` passes in all 5 affected modules  
- [x] `go test ./...` passes in `constructor`, `input/dir`,
`input/file`, `input/utf8`
- [x] `go test ./...` passes in `plugin` (96 files changed, all
registry/handler/flow tests pass)
- [ ] Integration tests with downstream modules (gates 6-8 not yet
migrated)

---------

Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

)

## Summary

Gate 6 of the phased [ADR 0018 / issue
#1047](open-component-model/ocm-project#1047)
credentials migration. Builds on gates 1–5 (PRs #2580, #2586, #2594,
#2598, #2602).

> **Note:** this branch also contains #2613 (plugin
`CredentialsFromHeader` refactor). Once that merges, this PR will show
only the helm changes.

### helm binding changes

- `cmd/main.go`, `input/method.go`: `ProcessResource`/`ProcessSource` →
`runtime.Typed`
- `digest/digest.go`: `ProcessResourceDigest` → `runtime.Typed`; single
`ConvertCredentials` call replaces two separate conversions
- `repository/resource/resource_repository.go`:
`DownloadResource`/`UploadResource` → `runtime.Typed`; `var _
repository.ResourceRepository` assertion restored
- `transformation/get_helm_chart.go`: use upstream typed
`ResourceRepository` interface; delete `transformation/credentials.go`
- `spec/credentials/v1/convert.go`: new
`ConvertCredentials(runtime.Typed) (*HelmHTTPCredentials,
*OCICredentials, error)` — single scheme-based conversion returning both
types
- `spec/credentials/scheme.go`: package-level `Scheme` for helm
credentials
- `spec/credentials/v1/helm_credentials.go`: remove deprecated exported
constants and `FromDirectCredentials` (now private)
- `go.mod`: `plugin` → v0.0.16, `blob` → v0.0.13, `repository` → v0.0.9;
no replace directives

## Test plan

- [ ] `cd bindings/go/helm && go build ./... && go test ./...` (cmd/*
requires `task build` for plugin binary)
- [ ] `grep -rn "map\[string\]string" bindings/go/helm/` returns no
credential parameter usages

Refs: #1047

Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

…entials (gate 7) (#2616)

#### What this PR does / why we need it

Gate 7 of the typed credentials migration (ocm-project#1047).

Migrates `bindings/go/transfer` and `kubernetes/controller` to use
`runtime.Typed` credentials instead of `map[string]string`.

**bindings/go/transfer:**
- Bump `blob→v0.0.13`, `credentials→v0.0.12`, `oci→v0.0.43`,
`repository→v0.0.9`
- Update OCI identity import path: `oci/spec/credentials/identity/v1` →
`oci/spec/identity/v1`

**kubernetes/controller:**
- `resolveResourceCredentials` and `VerifyResource` return
`runtime.Typed` instead of `map[string]string`
- Replace `map[string]string` RSA credential literals with
`rsacredentialsv1.RSACredentials` structs
- Update import aliases for `oci/spec/credentials` and
`oci/spec/identity/v1`
- `GetComponentVersionRepository` call sites updated to pass
`runtime.Typed` credentials

#### Which issue(s) this PR fixes

Contributes:
- open-component-model/ocm-project#1047
- open-component-model/ocm-project#1055
- open-component-model/ocm-project#1056
- open-component-model/ocm-project#1057

#### Binding release order

| Gate | PRs | Modules | Status |
|------|-----|---------|--------|
| 1 | ✅ #2580 | blob, signing, rsa | merged |
| 2 | ✅ #2586 | repository, sigstore | merged |
| 3 | ✅ #2594 | oci | merged |
| 4 | ✅ #2598 | constructor | merged |
| 5 | ✅ #2602 | plugin, input/dir, input/file, input/utf8 | merged |
| 6 | ✅ #2612 | helm | merged |
| 7 | **this PR** | transfer, controller | 👈 |
| 8 | PR 8 | cli | — |

---------

Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
Signed-off-by: Matthias Bruns <git@matthiasbruns.com>
Co-authored-by: Matthias Bruns <git@matthiasbruns.com>

On-behalf-of: SAP <matthias.bruns@sap.com>

<!-- markdownlint-disable MD041 -->
#### What this PR does / why we need it
Final PR of the breaking change chain for the credential migration.
This PR updated the CLI.

#### Which issue(s) this PR fixes
Fixed: open-component-model/ocm-project#1056

| Gate | PRs | Modules | Status |
|------|-----|---------|--------|
| 1 | ✅ #2580 | blob, signing, rsa | merged |
| 2 | ✅ #2586 | repository, sigstore | merged |
| 3 | ✅ #2594 | oci | merged |
| 4 | ✅ #2598 | constructor | merged |
| 5 | ✅ #2602 | plugin, input/dir, input/file, input/utf8 | merged |
| 6 | ✅ #2612 | helm | merged |
| 7 | ✅  #2616 | transfer, controller | merged |
| 8 | **this PR** | cli | 👈 |

#### Testing

##### How to test the changes

##### Verification

- [ ] I have added/updated tests for my changes (see [Test
Requirements](../CONTRIBUTING.md#test-requirements))
- [x] Tests pass locally (`task test` and `task test/integration` if
applicable)
- [ ] If touching multiple modules, `go work` is enabled (see `go.work`)
- [x] My changes do not decrease test coverage
- [ ] I have tested the changes locally by running `ocm`

---------

Signed-off-by: Matthias Bruns <git@matthiasbruns.com>