policy-test: use local registry

[davidweisse]

This uses the --insecure-registry flag from #2580 to configure a local registry via crane registry serve during the policy test suite evaluation. To use this, first run just policy-registry and wait until it says Registry is ready.. Then run just policy. The first target will start a local registry via crane registry serve and push the needed images into it while also writing to the image replacements file.

One problem is: genpolicy also pulls the configured pause image (ghcr.io/edgelesssys/kuberenetes/pause:3.6 in our case), which cannot be replaced by the image replacements file, since it isn't present in any of the deployment YAMLs. We configure ghcr.io as an insecure registry and set up an HTTP proxy that reroutes requests to ghcr.io to the local registry. For this to work, we of course push the pause image to the local registry beforehand.

Doing some testing, I get the following results:

• The first image pull will always take longer, as it has to pull the layers. About 2-3s to pull busybox from a local registry.
• Subsequent pulls only need the manifest/config, this takes ~120ms.
• Policy evaluation takes ~30-50ms for each RPC request.

Fixes CON-251

This PR is currently rebased on both #2580 and #2582, so only the most recent commit is relevant.

[linear-code]

CON-251

[davidweisse]

Update: Instead of the weird proxy setup, we can dynamically overwrite the pause image in the genpolicy settings file before running contrast generate. We can then explicitly pass that file to generate via a command line flag.

Also, with the rebase, the rego evaluation timing goes down to <10ms (~10-20ms max for CreateContainerRequest and <1ms for for others)