kubelet: Configure cri-o container registries

The _containers-image_ role configures _containers-registries.conf(5)_ and
_containers-cert.d(5)_, which are used by CRI-O (and `podman`).
Specifically, we'll use these to redirect requests for images on Docker
Hub (docker.io) to the internal caching proxy.

roles/containers-image/templates/registries.conf.j2

@@ -0,0 +1,6 @@
+{% for registry in container_registries|d([]) %}
+[[registry]]
+{% for key, value in registry|dictsort %}
+{{ key }} = {{ value | to_json }}
+{% endfor %}
+{% endfor %}