Support cli var substitution in docker login command env

[andylizf]

Fix #2707.

This PR supports variable substitution$(...) in docker login envs including SKYPILOT_DOCKER_USERNAME, SKYPILOT_DOCKER_PASSWORD and SKYPILOT_DOCKER_SERVER. This is particularly useful when users need a dynamic pswd, like $(aws ecr get-login-password --region us-west-2).

Tests:

I manually create a private image, and store my docker access token in pswd.txt, then:

andyl@andylizf-dev-server ~/skypilot (fix-docker-password)> docker run andylizf/skypilot-ssh-test                                                                          (sky) 
Unable to find image 'andylizf/skypilot-ssh-test:latest' locally
docker: Error response from daemon: pull access denied for andylizf/skypilot-ssh-test, repository does not exist or may require 'docker login': denied: requested access to the resource is denied.
See 'docker run --help'.

andyl@andylizf-dev-server ~/skypilot (fix-docker-password) > sky api stop;  sky launch _a/helloworld.yaml --cloud gcp                                                     (sky) 
SkyPilot API server stopped.
YAML to run: _a/helloworld.yaml
Successfully executed command for Docker password
Successfully executed command for Docker password
Failed to connect to SkyPilot API server at http://127.0.0.1:46580. Starting a local server.
✓ SkyPilot API server started.
Considered resources (1 node):
----------------------------------------------------------------------------------------------
 CLOUD   INSTANCE        vCPUs   Mem(GB)   ACCELERATORS   REGION/ZONE     COST ($)   CHOSEN   
----------------------------------------------------------------------------------------------
 GCP     n2-standard-2   2       8         -              us-central1-a   0.10          ✔     
----------------------------------------------------------------------------------------------
Launching a new cluster 'sky-f623-andyl'. Proceed? [Y/n]: 
⚙︎ Launching on GCP us-central1 (us-central1-a).
├── Instance is up.
⠼ Launching - Initializing docker container  View logs: sky api logs -l sky-2025-0
└── Docker container is up.
⠴ Preparing SkyPilot runtime (2/3 - dependencies)  View logs: sky api logs -l sky-2025-03-08-04-52-08-695025/provision.log

No idea why Successfully executed command for Docker password appears twice, seems like a known issue, is the DockerLoginConfig inited multiple times causing from_env_vars executed multiple times? Executing user-provided commands not just once may have some issues here. Cc'ing @cblmemo

[andylizf]

Also. we only update the sky/provision/docker_utils.py. Do we need to also update the legacy one sky/skylet/providers/command_runner.py?

[cblmemo]

As discussed in our meeting, we might want to move the execution to the skypilot cluster instead of local laptop.