image-copy-ecr: avoid spammy misleading error log when pushing to cgr.dev

[imjasonh]

// Ordering matters here, as the first keychain that can resolve the resource will be used.
// When pushing to CGR we want to try the Chainguard keychain first, since the ECR keychain
// logs a misleading error message when it's invoked for a non-ECR registry. The CGR keychain
// does not log such an error, so it's better to try it first.