Container manifests can define docker registry

- Allows for each image to be pulled from a custom docker registry
- ContainerManifest can specify authentication for a private registry
- No breaking changes
Registry should be more tightly coupled with image in my mind - the registry and auth is a subset of the identification of the image.  Also, images can be specified with a registry baked in - does this value override that?  That makes me think more about the following structure:

* image opaque string OR
* image struct
 * image name
 * registry
 * auth