Support dynamic push credentials obtained from registry

[manics]

Extracted from https://github.com/jupyterhub/binderhub/pull/1637 This is required to support time-limited registry credentials, as required by AWS ECR.

Required for https://github.com/jupyterhub/mybinder.org-deploy/issues/2629

[manics]

What do you think of the updated docs? I've renamed the new property.

Do you think it's worth switching to a dynamic secret instead, ~and not have a new property~ a new property is required, otherwise the secret needs to be created outside the Kubernetes builder which breaks the abstraction.

[manics]

Both of these environment variables are used by repo2docker:

• https://github.com/jupyterhub/repo2docker/blob/247e9535b167112cabf69eed59a6947e4af1ee34/docker/git-credential-env
• https://github.com/jupyterhub/repo2docker/blob/247e9535b167112cabf69eed59a6947e4af1ee34/repo2docker/engine.py#L148-L177

In hindsight prefixing them with R2D_ would've been a good idea and makes sense for future additions. We could add new R2D_ env vars and check for both old and new, but that risks adding to the confusion.