don't resolve endpoint hostnames DNS

This fixes #9708 . The tradeoff is, DNS resolution can no longer be used to match against insecure registries list. As a consequence, 127.0.0.1 is still automatically insecure, but localhost is not anymore.

Hostnames can still be matched verbatim against other hostnames.