Check for push permissions before building

If I'm ko publishing to a registry/repository that I don't have push permissions to (typo, misconfigured auth, incorrect active gcloud user), ko can check that and fail before building, using ggcr's CheckPushPermission.

That has a TODO(https://github.com/google/go-containerregistry/issues/412) to make it unnecessary, but I think this is actually a case where it's useful, since it can avoid work and save time before remote.Writeing.