zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

### Summary A bearer token with only `pull` and `push` scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the `"push"` action, and the `DistSpecAuthzHandler` middleware is bypassed entirely for bearer-authenticated requests. This allows any client holding a push-only bearer token to delete arbitrary manifests and blobs within the token's repository scope, in violation of the [Docker Distribution Token Authentication Specification](https://distribution.github.io/distribution/spec/auth/scope/). ### Details The vulnerability exists in two interacting components: **1. Action Mapping Collapse (`pkg/api/authn.go:571–586`)** The bearer authentication handler maps HTTP methods to token scope actions using a binary check: ```go action := "pull" if m := request.Method; m != http.MethodGet && m != http.MethodHead { action = "push" } ``` This collapses DELETE, PUT, PATCH, and POST into a single `"push"` action. The `"delete"` action is never assigned. **2. Authorization Bypass for Bearer Auth (`pkg/api/authz.go:270–275, 318–323`)** When a request is authenticated via bearer token, the `DistSpecAuthzHandler` middleware, which performs fine-grained action inference (distinguishing `create`, `read`, `update`, and `delete`) is bypassed entirely: ```go if err != nil || (authnMwCtx != nil && authnMwCtx.AuthnType == BEARER) { next.ServeHTTP(response, request) return } ``` **3. No Hand