Improve spec coverage for dependency proxy for containers

What does this MR do and why?

This was extracted from !129697 (merged).

That MR contained:

• 1️⃣ changes to add scope checks when using a group access token for dependency proxy for containers
• 2️⃣ refactorings related to the changes in 1️⃣
• 3️⃣ spec changes to add spec coverage, to increase confidence in the refactorings in 2️⃣

!129697 (merged) had to be reverted because of a 🐛 in 1️⃣

!136655 (merged) will recreate the changes in !129697 (merged), plus the 🐛 fixes. To reduce the scope of that MR, I extracted the changes in 3️⃣ into this MR. That MR will also need to re-reviewed by groupauthorization . I'm sure they'll appreciate the reduction in the MR they're going to re-review 😅

Screenshots or screen recordings

No UI changes, these are spec-only changes 🌈

How to set up and validate locally

No behavior changes 🌈

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #431386