Add ARTIFACTAPI_AUTH_UPLOADS to require a verified token for local
uploads, deletes, evictions, /api/v1 publishes and /v2 push. Accept the
token as Bearer, Token, Basic password or bare header, and serve a
Docker registry token endpoint so pulls stay anonymous.
