…als v0.0.12 compat) (#2603)

## Summary

- `credentials v0.0.12` unified the `Resolver` interface to a single
`Resolve(ctx, identity) (runtime.Typed, error)` method, removing the
separate `ResolveTyped` method that existed in v0.0.11
- `constructor v0.0.8` (released as part of gate 4, PR #2598) still
calls `provider.ResolveTyped` and depends on `credentials v0.0.11`
- This causes a build failure when any module depends on both
`constructor v0.0.8` and `credentials v0.0.12`

This fix updates `construct.go` to call `provider.Resolve` and bumps the
credentials dependency to `v0.0.12`.

## Dependency on
Must be released as `constructor/v0.0.9` before PR #2602 (gate 5 plugin
migration) can drop its `replace` directive.

Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

Gate 5 (open-component-model#2602) migrated credential parameters to runtime.Typed but left
inline JSON parsing in every registry handler. Extract the repeated
Authorization header → runtime.Raw parsing into a shared helper and
update all handlers to use it.

- Add plugins/credentials.go: CredentialsFromHeader reads the
  Authorization header and unmarshals it into runtime.Typed, writing
  an HTTP 401 on malformed input
- Update all registry handlers (blobtransformer, componentlister,
  credentialrepository, digestprocessor, input, resource) to use it
- plugins/call.go: skip headers with empty key

Refs: open-component-model#1047
On-behalf-of: @SAP <jakob.moeller@sap.com>

Gate 5 (open-component-model#2602) migrated credential parameters to runtime.Typed but left
inline JSON parsing in every registry handler. Extract the repeated
Authorization header → runtime.Raw parsing into a shared helper and
update all handlers to use it.

- Add plugins/credentials.go: CredentialsFromHeader reads the
  Authorization header and unmarshals it into runtime.Typed, writing
  an HTTP 401 on malformed input
- Update all registry handlers (blobtransformer, componentlister,
  credentialrepository, digestprocessor, input, resource) to use it
- plugins/call.go: skip headers with empty key

Refs: open-component-model#1047
On-behalf-of: @SAP <jakob.moeller@sap.com>
Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
On-behalf-of: @SAP <jakob.moeller@sap.com>

Gate 5 (open-component-model#2602) migrated credential parameters to runtime.Typed but left
inline JSON parsing in every registry handler. Extract the repeated
Authorization header → runtime.Raw parsing into a shared helper and
update all handlers to use it.

- Add plugins/credentials.go: CredentialsFromHeader reads the
  Authorization header and unmarshals it into runtime.Typed, writing
  an HTTP 401 on malformed input
- Update all registry handlers (blobtransformer, componentlister,
  credentialrepository, digestprocessor, input, resource) to use it
- plugins/call.go: skip headers with empty key

Refs: open-component-model#1047
On-behalf-of: @SAP <jakob.moeller@sap.com>
Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
On-behalf-of: @SAP <jakob.moeller@sap.com>

Gate 5 (open-component-model#2602) migrated credential parameters to runtime.Typed but left
inline JSON parsing in every registry handler. Extract the repeated
Authorization header → runtime.Raw parsing into a shared helper and
update all handlers to use it.

- Add plugins/credentials.go: CredentialsFromHeader reads the
  Authorization header and unmarshals it into runtime.Typed, writing
  an HTTP 401 on malformed input
- Update all registry handlers (blobtransformer, componentlister,
  credentialrepository, digestprocessor, input, resource) to use it
- plugins/call.go: skip headers with empty key

Refs: open-component-model#1047
On-behalf-of: @SAP <jakob.moeller@sap.com>
Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
On-behalf-of: @SAP <jakob.moeller@sap.com>

)

## Summary

Gate 6 of the phased [ADR 0018 / issue
#1047](open-component-model/ocm-project#1047)
credentials migration. Builds on gates 1–5 (PRs #2580, #2586, #2594,
#2598, #2602).

> **Note:** this branch also contains #2613 (plugin
`CredentialsFromHeader` refactor). Once that merges, this PR will show
only the helm changes.

### helm binding changes

- `cmd/main.go`, `input/method.go`: `ProcessResource`/`ProcessSource` →
`runtime.Typed`
- `digest/digest.go`: `ProcessResourceDigest` → `runtime.Typed`; single
`ConvertCredentials` call replaces two separate conversions
- `repository/resource/resource_repository.go`:
`DownloadResource`/`UploadResource` → `runtime.Typed`; `var _
repository.ResourceRepository` assertion restored
- `transformation/get_helm_chart.go`: use upstream typed
`ResourceRepository` interface; delete `transformation/credentials.go`
- `spec/credentials/v1/convert.go`: new
`ConvertCredentials(runtime.Typed) (*HelmHTTPCredentials,
*OCICredentials, error)` — single scheme-based conversion returning both
types
- `spec/credentials/scheme.go`: package-level `Scheme` for helm
credentials
- `spec/credentials/v1/helm_credentials.go`: remove deprecated exported
constants and `FromDirectCredentials` (now private)
- `go.mod`: `plugin` → v0.0.16, `blob` → v0.0.13, `repository` → v0.0.9;
no replace directives

## Test plan

- [ ] `cd bindings/go/helm && go build ./... && go test ./...` (cmd/*
requires `task build` for plugin binary)
- [ ] `grep -rn "map\[string\]string" bindings/go/helm/` returns no
credential parameter usages

Refs: #1047

Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

## Summary

Gate 5 (#2602) migrated all credential parameters to `runtime.Typed` but
left the Authorization header → `runtime.Raw` parsing duplicated inline
in every registry handler. This PR extracts that into a shared helper.

- Add `plugins/credentials.go`: `CredentialsFromHeader` reads the
`Authorization` header, unmarshals it into `runtime.Typed`, and writes
HTTP 401 on malformed input
- Update all registry handlers to use it: `blobtransformer`,
`componentlister`, `credentialrepository`, `digestprocessor`, `input`,
`resource`
- `plugins/call.go`: skip headers with empty key

No behaviour change — pure extraction of duplicated code.

## Test plan

- [ ] `cd bindings/go/plugin && go build ./... && go test ./...`

Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

…entials (gate 7) (#2616)

#### What this PR does / why we need it

Gate 7 of the typed credentials migration (ocm-project#1047).

Migrates `bindings/go/transfer` and `kubernetes/controller` to use
`runtime.Typed` credentials instead of `map[string]string`.

**bindings/go/transfer:**
- Bump `blob→v0.0.13`, `credentials→v0.0.12`, `oci→v0.0.43`,
`repository→v0.0.9`
- Update OCI identity import path: `oci/spec/credentials/identity/v1` →
`oci/spec/identity/v1`

**kubernetes/controller:**
- `resolveResourceCredentials` and `VerifyResource` return
`runtime.Typed` instead of `map[string]string`
- Replace `map[string]string` RSA credential literals with
`rsacredentialsv1.RSACredentials` structs
- Update import aliases for `oci/spec/credentials` and
`oci/spec/identity/v1`
- `GetComponentVersionRepository` call sites updated to pass
`runtime.Typed` credentials

#### Which issue(s) this PR fixes

Contributes:
- open-component-model/ocm-project#1047
- open-component-model/ocm-project#1055
- open-component-model/ocm-project#1056
- open-component-model/ocm-project#1057

#### Binding release order

| Gate | PRs | Modules | Status |
|------|-----|---------|--------|
| 1 | ✅ #2580 | blob, signing, rsa | merged |
| 2 | ✅ #2586 | repository, sigstore | merged |
| 3 | ✅ #2594 | oci | merged |
| 4 | ✅ #2598 | constructor | merged |
| 5 | ✅ #2602 | plugin, input/dir, input/file, input/utf8 | merged |
| 6 | ✅ #2612 | helm | merged |
| 7 | **this PR** | transfer, controller | 👈 |
| 8 | PR 8 | cli | — |

---------

Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
Signed-off-by: Matthias Bruns <git@matthiasbruns.com>
Co-authored-by: Matthias Bruns <git@matthiasbruns.com>

On-behalf-of: SAP <matthias.bruns@sap.com>

<!-- markdownlint-disable MD041 -->
#### What this PR does / why we need it
Final PR of the breaking change chain for the credential migration.
This PR updated the CLI.

#### Which issue(s) this PR fixes
Fixed: open-component-model/ocm-project#1056

| Gate | PRs | Modules | Status |
|------|-----|---------|--------|
| 1 | ✅ #2580 | blob, signing, rsa | merged |
| 2 | ✅ #2586 | repository, sigstore | merged |
| 3 | ✅ #2594 | oci | merged |
| 4 | ✅ #2598 | constructor | merged |
| 5 | ✅ #2602 | plugin, input/dir, input/file, input/utf8 | merged |
| 6 | ✅ #2612 | helm | merged |
| 7 | ✅  #2616 | transfer, controller | merged |
| 8 | **this PR** | cli | 👈 |

#### Testing

##### How to test the changes

##### Verification

- [ ] I have added/updated tests for my changes (see [Test
Requirements](../CONTRIBUTING.md#test-requirements))
- [x] Tests pass locally (`task test` and `task test/integration` if
applicable)
- [ ] If touching multiple modules, `go work` is enabled (see `go.work`)
- [x] My changes do not decrease test coverage
- [ ] I have tested the changes locally by running `ocm`

---------

Signed-off-by: Matthias Bruns <git@matthiasbruns.com>