Use keyring --mode creds when authenticate = "always"

[zanieb]

Previously, we required a username to perform a fetch from the keyring because the keyring CLI only supported fetching password for a given service and username. Unfortunately, this is different from the keyring Python API which supported fetching a username and password for a given service. We can't (easily) use the Python API because we don't expect keyring to be installed in a specific environment during network requests. This means that we did not have parity with pip.

Way back in jaraco/keyring#678 we got a --mode creds flag added to keyring's CLI which supports parity with the Python API. Since keyring is expensive to invoke and we cannot be certain that users are on the latest version of keyring, we've not added support for invoking keyring with this flag. However, now that we have a mode that says authentication is required for an index (#11896), we might as well try to invoke keyring with --mode creds when there is no username. This will address use-cases where the username is non-constant and move us closer to pip parity.

[zanieb]

There's not a good place to put this in the documentation yet. I'll follow up with some changes?