Container manifests can define docker registry

- Allows for each image to be pulled from a custom docker registry
- ContainerManifest can specify authentication for a private registry
- No breaking changes
That is a good question. Right now, the underlying `go-dockerclient` library supports only DockerHub auth and hence this implementation. I agree that a single Auth struct would not work for all the real world cases, and in some cases the best option would be to authenticate the `Docker Daemon` (e.g. client cert). However as I mentioned in a comment before - we could implement reading the credentials from `.dockercfg`, but there might still be a need to provide credentials for specific images.  

In the past in places where a _configuration_ needs to allow different formats we have used the following:

- Declare an interface that _handlers_ must implement. In this case it could be `DockerRegistryAuth` that is implemented by `DockerHubRegistryAuth`. 
- This interface enforces a method for `deserializing` the details of the object. So `Container` would just load the config into an `Interface{}`.
- Unfortunately, since the Authentication must be passed to the `dockerclient` for it to make authenticated requests the Interface must also take a `DockerClient` and mutate it (or call a function on it) to set the authorization parameters. 

An example implementation of this can be seen at https://github.com/Clever/sphinx/blob/master/matchers/matchers.go#L43

I can try and write up an example of how this would work for this use case, do let me know.