Authenticated docker pulls, pt. I

The simplest reasonable thing to do here is to read the `.dockercfg` files that are already available to the kubelets. This only happens on startup, so any changes the user makes  to `.dockercfg` will only be applied after a service restart.
I wasn't quite sure how this lookup method was going to evolve, so I didn't want to pre-optimize and add any fields that may have gotten ripped out immediately. I'll go ahead and optimize the lookups in this keyring a bit.