In particular, this addresses a case where a user-facing registry redirects to blob storage in S3, providing a URL that includes various X-Amz-* query parameters. S3 refuses requests that have both Authentication header and authentication query parameters.

I think this is generally safe to do. If the redirect is to a different path under the same registry, then the request to new location would include another authentication challenge and the same authentication helper rules would be applied, restoring auth. If the redirect is to a different domain, then I wouldn't expect the same authentication to be accepted anyway, so dropping auth info seems generally desirable.