This tweaks how we create a resolver so that we handle plain http
connections, and TLS validation the same way as Docker.

* When a loopback address is specified as insecure, that should take
  precedence over it being plain http. So if I'm running a local
  registry with self-signed certificates, it should use the skipTLS http
  client, and not attempt to use plain http.
* All loopback addresses, not just localhost and 127.0.0.1, should
  default to plain http unless specified as insecure.

The impact is that you only need to specify that a registry is insecure
when:

* You used self-signed certificates
* It uses plain http on a non-loopback address

When I was looking at the docker library we are using to create a
resolver, I saw that we were using deprecated functionality. By using
the Hosts function that is called per registry to determine how to
connect to that registry, I was able to simplify the resolver and not
need to create 3 separate resolvers.

Signed-off-by: Carolyn Van Slyck <[email protected]>

Match insecure registry behavior from Docker