BUG: oci_pull hides error messages from URL rewriter

[thesayyn]

When url rewriter blocks the requests made by oci_pull, due to legacy reasons we write an error message that says

Unable to retrieve the image manifest. This could be due to authentication problems or an attempt to fetch an image with OCI image media types.
See: https://github.com/bazel-contrib/rules_oci/blob/main/docs/pull.md#authentication-using-credential-helpers

however, in other rulesets you get an error message stating the explicit reason why it failed,

 Configured URL rewriter blocked all URLs: [https://go.dev/dl/?mode=json&include=all, https://golang.google.cn/dl/?mode=json&include=all]

[thesayyn]

We should drop this behavior on rules_oci@3

[sfc-gh-mhazy]

Hi, just wanted to mention bazelbuild/bazel#23207 for debugging / visibility.

This leads to hard to debug errors with rules_oci when using url rewriter.

[thesayyn]

Hi, just wanted to mention bazelbuild/bazel#23207 for debugging / visibility.

Thanks. i doubt that Bazel will accept that patch as there are legit use cases where Auth headers should not be forwarded.

Going to close this as completed: #675