Possible 401 Unauthorized when base image is referred to by a digest and manifest is cached

[chanseokoh]

Observed this in #2215.

If the Jib cache is empty, Docker Hub returns 404 (and fail) in the first run. Interestingly, subsequent runs return 401. Worth understanding why.

When a base image is referred to by a digest, we first look into the manifest cache. If the manifest is in the cache, we return it along with no (i.e., null) base image credentials.

    if (buildContext.isOffline() || imageReference.isTagDigest()) {
      Optional<Image> image = getCachedBaseImage();
      if (image.isPresent()) {
        return new ImageAndAuthorization(image.get(), null);
      }

However, if the base image cache is missing some layers (e.g., pulling base image layers failed for some reason after caching the manifest), Jib will go out and try to download the missing layers. But it may fail because we didn't return base image credentials above.

[emmileaf]

Closing as fixed by layers check added in #3767.