fix: normalize registry root authorization

[KAJdev]

Classifies / and /v2/ as registry base paths using parsed URL pathnames, independent of deployment hostname. Base-path requests require a token with at least one capability, giving registry discovery consistent authorization semantics across custom domains.

Addresses SLS-306.

[jebenexer]

LGTM — new URL(request.url).pathname correctly normalizes percent-encoding, double slashes, and ./.. segments, so the hostname-agnostic exact-match check on / and /v2/ closes the anonymous-discovery bypass on custom domains without introducing new bypass surface (checked query-param stripping, trailing-slash handling, and dot-segment resolution — all fold to the expected canonical path). Case-sensitive match against lowercase /v2/ is correct per the OCI spec.

Test coverage looks right: no-capability tokens rejected on base paths across hostnames, any-capability tokens allowed through.

Note (non-blocking): worth an explicit test for /V2/ (case variant) and /v2 (no trailing slash) just to document intended behavior, though I don't think either represents a real bypass given the pathname parsing.

The BLOCKED mergeable_state here is a repo config issue (zero CI checks configured), not a code issue — that'll need a branch-protection/CI setup fix separately from this PR merging.