Problem: normally, the reason we get the HTTP 401 when working with OCI registries is the initial lack of token, in which case AuthenticationKeeper will have no Authentication set, and the authenticationKeeper.header() will return nil.

However, sometimes the cause for the HTTP 401 is that the scopes mismatch, and since the AuthenticationKeeper now already has Authentication, we'll happily add it to a request for a new token (not just for a regular OCI request):

This results in a token request with two values in the Authorization and causes HTTP 400 for e.g. GitLab Registry.

Solution: never consider AuthenticationKeeper when making a request for a new token.

Resolves #914.