Authenticated docker pulls, pt. I

The simplest reasonable thing to do here is to read the `.dockercfg` files that are already available to the kubelets. This only happens on startup, so any changes the user makes  to `.dockercfg` will only be applied after a service restart.
Optional suggestion:
there aren't going to be many keys so linear search won't be measurably slower, so maybe drop the reindex() and just define:
type dockerKeyring map[string]docker.AuthConfiguration
k := make(dockerKeyring)
add(r,c) -> k[r] = c
lookup(i) changes in the obvious way.

saves other readers from having to figure out the data structure.