Adds https mode to credentialConfig

[juliusl]

What this PR does / why we need it:
Similar to the current http credentialConfig mode, this PR adds a https mode with additional options for enabling full mTLS with a local auth server.

This enables hardening localhost connections in environments that may allow merged network namespaces w/ running containers.

Tested integration manually w/ private build of AKS/ACR artifact streaming.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Please check the following list:

• Does the affected code have corresponding tests, e.g. unit test, E2E test?
• Does this change require a documentation update?
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have an appropriate license header?

[BigVan]

Maybe we can add a 'certs.d' dir like contiainerd to support multiple Registry and credential Server
such as:
' /etc/overlaybd/certs.d//client.key'
' /etc/overlaybd/certs.d//client.crt'
' /etc/overlaybd/certs.d//ca.crt'

[juliusl]

That containerd feature still requires the cert paths to be configured in a hosts.toml file, it doesn't automatically pick certs from the folder.

Also it works by routing by host matching directories, while the current feature centralizes credential fetching from a single source. It would be a new design altogether since this change is about securing the connection used by the current design.

[BigVan]

That containerd feature still requires the cert paths to be configured in a hosts.toml file, it doesn't automatically pick certs from the folder.

Also it works by routing by host matching directories, while the current feature centralizes credential fetching from a single source. It would be a new design altogether since this change is about securing the connection used by the current design.

Fine...
What you said does make sense. Actually, Databricks mentioned to me about the customized certification for their self-registries a few days ago 😂
However, create a new PR is also possible