Implement blob streaming sync with on-demand support

- Add SyncBlob method to sync service and on-demand interface
- Integrate blob sync into GetBlob API handler
- Use regclient to fetch blobs from upstream
- Automatically trigger sync when blob not found locally
- Handle sync errors gracefully with retry to local storage

This implements the core requirement from PR #3733 discussion:
check if blob exists, if not, sync from upstream on-demand.

Co-authored-by: rchincha <45800463+rchincha@users.noreply.github.com>

pkg/api/controller.go

@@ -14,6 +14,7 @@ import (
 	"strings"
 	"time"
 
+	godigest "github.com/opencontainers/go-digest"
 	"github.com/gorilla/mux"
 	"github.com/gorilla/securecookie"
 	"github.com/zitadel/oidc/v3/pkg/client/rp"
@@ -588,4 +589,5 @@ func RunGCTasks(conf *config.Config, storeController storage.StoreController, me
 type SyncOnDemand interface {
 	SyncImage(ctx context.Context, repo, reference string) error
 	SyncReferrers(ctx context.Context, repo string, subjectDigestStr string, referenceTypes []string) error
+	SyncBlob(ctx context.Context, repo string, digest godigest.Digest) error
 }