Authenticated docker pulls, pt. I

The simplest reasonable thing to do here is to read the `.dockercfg` files that are already available to the kubelets. This only happens on startup, so any changes the user makes  to `.dockercfg` will only be applied after a service restart.
This is extremely mysterious, please add a comment. I don't understand why you keep a sorted list but run through it linearly-- if you're going to do that, why not just range through the map directly?