If new_base is in another repository (but in the same registry), we need to cross-repo mount that image's layers into rebased's repository.

If new_base is in another registry from rebased (e.g., ubuntu on Dockerhub, with rebased in GCR), its layers need to be fetched and uploaded to rebased's registry and repository. There is no Registry API for this, so we have to pull and push layers through the client.

If an image has a label of the form something like:

LABEL rebase=<base image by digest> <base image by tag>

The tool can use that information to determine --old_base and --new_base without having to be told.

The tool can also inject that information into rebased images, for future rebasings, even if the original rebase didn't advertise the label.

Shell out to any configured credential helper for the request registry(s) to get an auth token to authorize requests.