Docker: an image a selector of the caller's own grant hides answers 404 (NAME_UNKNOWN), not 403 #703

Follow-up of #648 (fixed by #700), whose acceptance criteria ask that Docker's manifest, blob, tag list and referrers answer 404, like a package that does not exist, for an image the caller may not read.

That holds through a group when the image is hidden by a member the caller cannot read or by a selector on a member's grant. It does not when the selector is on the grant of the requested repository (a group, or a hosted or proxy repository pulled directly): Registry::decide (crates/server/src/images/dispatch.rs) folds the selector into the permission check, so the request is refused with 403 DENIED (401 for an anonymous caller). The answer depends on the name alone, so it does not tell an existing image from an absent one, but it differs from NuGet and npm, where an id a selector hides is not found, and from the 404 the issue asks for.

Fix

• A read of an image the caller may read the repository of, but that a selector of its grant hides, answers 404 NAME_UNKNOWN on every endpoint under /v2/<name>/ (manifests, blobs, tags, referrers), like a name that does not exist. Nothing is fetched from a proxy's upstream for it.
• Pushes and deletes outside the selector stay refused with 403, as in the other formats.
• A caller who may not read the repository at all is refused as before (401/403).
• Registry tokens keep granting pull only on names the caller may read.

Acceptance criteria

• The Groups and content selectors: a reader sees only the members and packages they may read; raw listings name hidden entries in next #648 test (groups_show_a_caller_only_the_images_it_may_read) expects 404 for a selector on the group's grant too, and a hosted repository with a selector answers 404 for a hidden image.
• A push outside the selector is still 403.
• docs/docker.md says what a hidden image answers; a changelog fragment.