Refine FetchToken Logic

[shizhMSFT]

Always do OAuth2 if creds is a refresh token, not a username / password pair.

Resolves #2554.

[tonistiigi]

@AkihiroSuda

This code was based on https://github.com/containerd/containerd/blame/main/remotes/docker/authorizer.go#L299 . Does it have a similar case or has it been updated or is the issue buildkit specific?

I think one related issue in here was that historically Docker hub only implemented one of the methods and we tried to avoid a discarded request on the default path. I think this has been fixed though and now both methods are supported. Could you verify that?

[shizhMSFT]

This code was based on https://github.com/containerd/containerd/blame/main/remotes/docker/authorizer.go#L299 . Does it have a similar case or has it been updated or is the issue buildkit specific?

Looks like the containerd code has been updated.

[tonistiigi]

Please squash the commits as everything in the first commit seems to be overwritten by the second one.

Please squash

[shizhMSFT]

@tonistiigi The commits have been squashed into one commit.