refactor: decouple artifact and auth packages

What does this MR do?

Started as "do not create a token during artifact handling if not needed" but got out of hand really quick.

This MR decouples auth and artifact package, allowing for more flexibility in artifact handling.

There is a small performance improvement because a token is only requested if needed (no need to request a token if it's not an artifact request). A few more cleanups are possible since the artifact server cannot be empty now that it is inferred.

TODO

• I added the Changelog trailer (e.g. Changelog: added) to the commits that need to be included in the changelog
• I added unit tests or they are not required
• I added acceptance tests or they are not required
• I added documentation (or it's not required)
• I followed code review guidelines
• I followed Go Style guidelines