Remote Downloader should support using custom credentials

[sluongng]

Description of the feature request:

Currently, the HttpDownloader does support credentials from netrc or a custom credential helper.

However, the GrpcRemoteDownloader backed by Remote Asset API simply ignores the credentials https://cs.opensource.google/bazel/bazel/+/master:src/main/java/com/google/devtools/build/lib/remote/downloader/GrpcRemoteDownloader.java;l=167;drc=0a0d877a6960db1f4054f9b6ac09b6c91c311548;bpv=0;bpt=1 which make it not possible to use remote_downloader against a URL that requires authentications.

Given that the credentials might be based on URL, we may want to extend the current QUALIFIER_HTTP_HEADER_PREFIX to also support different URLs, perhaps based on the order of the URLs added to the grpc request.,

Which category does this issue belong to?

Remote Execution

What underlying problem are you trying to solve with this feature?

No response

Which operating system are you running Bazel on?

No response

What is the output of bazel info release?

No response

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

No response

[sluongng]

cc: @r2r-dev

[jmillikin]

Normally your remote downloader implementation would contain logic for loading appropriate credentials. For example, if you're using it to redirect download requests to an internal caching proxy then that proxy should be configured with netrc (or equivalent).

[sluongng]

@jmillikin It's one way to set it up. However, in some settings where the remote downloader is shared between different isolated + diverse tenants, it might be desirable to forward the credentials from the client side (Bazel side) instead of keeping the credentials in one centralized location. This way, tenant foo could be using a different set of credentials headers from tenant bar.