local registry service

[smira]

Implement a Talos service which implements OCI Distribution API.

Note: containerd will send registry name (e.g. ghcr.io) as ?ns=ghcr.io.

A service is given a list of root paths containing image cache in the format described in #9611.

If the manifest/blob is available, service should deliver it, if not, it returns 404 to let containerd fallback to the next one.

Test plan: inject the local registry as the first endpoint in the mirrors list, pull should happen from the cache first, falling back to upstream.

[smira]

• support multiple paths