docker: retry transient pull failures

[crazy-max]

This retries docker pull when the Docker daemon reports transient registry or network failures, such as Docker Hub auth token timeouts, connection resets, DNS timeouts, EOF responses, and registry 5xx responses. Permanent pull failures still fail immediately, including access denied errors and Docker Hub rate limit errors, because retrying those just wastes time and can make the problem worse.

This helps reduce flakes in actions that pull setup images through the shared toolkit, especially docker/setup-qemu-action pulling tonistiigi/binfmt:latest.

Related issues:

• Error while pulling tonistiigi/binfmt:latest image setup-qemu-action#110 encountered Error response from daemon: Head "https://registry-1.docker.io/v2/tonistiigi/binfmt/manifests/latest": EOF.
• binfmt 503 on docker pull setup-qemu-action#94 encountered Error response from daemon: Head "https://registry-1.docker.io/v2/tonistiigi/binfmt/manifests/latest": received unexpected HTTP status: 503 Service Unavailable.
• Support cache tonistiigi/binfmt docker images setup-qemu-action#166 encountered dial tcp: lookup registry-1.docker.io on 127.0.0.53:53: read udp ... i/o timeout.
• Client.Timeout exceeded while awaiting headers setup-buildx-action#64 encountered Get https://registry-1.docker.io/v2/: net/http: request canceled (Client.Timeout exceeded while awaiting headers) while booting BuildKit.
• ERROR: Error response from daemon: Head "https://registry-1.docker.io/v2/moby/buildkit/manifests/buildx-stable-1": received unexpected HTTP status: 500 Internal Server Error setup-buildx-action#445 encountered received unexpected HTTP status: 500 Internal Server Error while pulling moby/buildkit:buildx-stable-1.
• 500 Internal Server Error setup-buildx-action#458 encountered download failed after attempts=6: received unexpected HTTP status: 500 Internal Server Error.