Authenticated docker pulls, pt. I

The simplest reasonable thing to do here is to read the `.dockercfg` files that are already available to the kubelets. This only happens on startup, so any changes the user makes  to `.dockercfg` will only be applied after a service restart.
The lookup logic should probably get a bit more advanced, too. It isn't actually going to do the same thing as the docker CLI right now in the case of a pod with image "quay.io/busybox" and the creds set up pointing at "https://quay.io". I'll address that before this lands.