As this is unfixed in VyOS 2025.06.17-0020-rolling. Is there a workaround that allows i.e to update container images without removing/adding the complete image/config?

technically the limit would be defined by the http header length (and httpd configured allowed header sizes), http basic auth itself has no restrictions in the context of being Base64 encoded.
Often restrictions are from tooling side, not protocol side. I.e Apache htpasswd generated passwords and usernames (under windows) are limited to 255 chars, but again this is a tool limit, not a header limit
(Source: https://httpd.apache.org/docs/2.4/programs/htpasswd.html#restrictions)
256 (255) could be a reasonable value that matches this specific constraint.