Container manifests can define docker registry

- Allows for each image to be pulled from a custom docker registry
- ContainerManifest can specify authentication for a private registry
- No breaking changes
Like Docker - "registry/repository/imagename".

In the long run Image field should probably be a shorthand for a real struct like:

    type ImageRef struct {
      Repository string
      Label string
      Registry string
      Auth struct...
    }  

There's also an ongoing discussion about making images content addressable via an ID that is generated based on the tar-sum of the content in that image + the manifest.  That might add another field to the ImageRef struct such as `ID string`