Working Example of Galaxy against a Content Guard Protected Ansible Repo

Problem:
The challenge I have is i have not for the life of been able through any combination of galaxy credentials and .netrc files (or anything else) been able to get ansible-galaxy to download protected collections.

Expected outcome:
I expect to have .netrc file + ansible galaxy credentials and be able to pull galaxy collections

Pulpcore version:
3.79.x maybe

Pulp plugins installed and their versions:
recentish ansible plugin 0.23.xxx

Operating system - distribution and version:
RHEL9

Other relevant data:
I am able to use a composite content guard of tls + basic auth to protect all my repo types (file, ansible and rpm). I can access it via mtls or pass --header Authorization Basic:(base64encoded user:password) with wget or wgetrc to download stuff.