Add registry authentication to service updates - #2693

Summary

Adds registry authentication support to UpdateServiceCmd, bringing service updates in line with the authentication support already available when creating services.

Problem

A service update can change its container image. When the new image is hosted in a private registry, Docker requires registry credentials in the X-Registry-Auth request header. UpdateServiceCmd did not expose an AuthConfig option, so callers could not provide those credentials and Swarm could not pull the private image during an update.

Implementation

• add optional AuthConfig accessors to UpdateServiceCmd
• store the authentication configuration in UpdateServiceCmdImpl with the project null-safety annotations and builder conventions
• apply the existing resourceWithOptionalAuthConfig helper before executing the service-update request
• extend PrivateRegistryRule so an integration test can run the registry in the same Docker daemon as the Swarm worker

Running the registry in the Swarm Docker-in-Docker daemon is important because localhost:5050 must resolve to the registry from the worker performing the image pull.

Compatibility

• existing callers do not need to provide authentication
• no X-Registry-Auth header is sent when AuthConfig is absent
• the existing service-update request body, version parameter, and response handling remain unchanged
• the feature uses the existing AuthConfig model and the existing authentication-header serialization path

Verification

• mvn -pl docker-java -am -Dtest=UpdateServiceCmdExecTest -Dsurefire.failIfNoSpecifiedTests=false test — 2 tests passed
• mvn -pl docker-java -am -DskipTests test-compile — Java 8 test compilation and checkstyle passed
• mvn -f docker-java/pom.xml -Dit.test=UpdateSwarmServiceIT#testUpdateServiceWithRegistryAuth org.apache.maven.plugins:maven-failsafe-plugin:3.0.0-M4:integration-test — 1 test passed
• git diff --check — passed

The executor tests verify both the serialized authentication header and its omission when authentication is not configured.

The integration test starts a service with a public image, pushes that image to an authenticated local registry, removes the local private-image tag, and then updates the service with AuthConfig. It waits until the replacement Swarm task is running the private image, ensuring the update really authenticated and pulled from the registry.