fix(registry): set default HTTP client timeout for registry client

The default http.Client had no Timeout, so an unresponsive registry could
hang helm registry operations indefinitely.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

pkg/registry/client.go

@@ -30,6 +30,7 @@ import (
 	"os"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/Masterminds/semver/v3"
 	"github.com/opencontainers/image-spec/specs-go"
@@ -97,6 +98,8 @@ func NewClient(options ...ClientOption) (*Client, error) {
 	}
 	if client.httpClient == nil {
 		client.httpClient = &http.Client{
+			// Bound registry operations so an unresponsive registry cannot hang forever.
+			Timeout:   30 * time.Second,
 			Transport: NewTransport(client.debug),
 		}
 	}