Container manifests can define docker registry

- Allows for each image to be pulled from a custom docker registry
- ContainerManifest can specify authentication for a private registry
- No breaking changes
The model that was in my head is:

1. DockerRegistry resource is added to system.
2. Pod gets a Registry field.
3. DockerRegistries have admission control; if you submit a pod that uses a particular registry, you have to be an authorized user of that registry (or be in a group that is, etc). This assumes as-yet nonexistent authentication and authorization control layers.