Authenticated docker pulls, pt. I

The simplest reasonable thing to do here is to read the `.dockercfg` files that are already available to the kubelets. This only happens on startup, so any changes the user makes  to `.dockercfg` will only be applied after a service restart.
I think it's time to create kubelet docker package - move this sort of generically useful function into it and make it public.  I'd move the lookup method here as well as a type of lookup (PrefixMatch?) if you think it will ever change.