There are scenarios in which the default system resolver is undesirable for resolving an image host - I.E, a registry that's only resolvable via a private DNS server.

This PR adds a dns_servers config option that allows one to configure DNS servers that get passed into the dial context used for image pulls. If the configured DNS server is unreachable, resolution falls back to the default host resolver as determined by net.Resolver.Dial.

Here, we expose two configuration options:

Global configuration in config.toml:

  [plugins."io.containerd.cri.v1.images".registry]
    dns_servers = ["192.168.1.53"]

Per-host via hosts.toml, overriding the global if set for that host only:

  [host."https://registry.example.com"]
    capabilities = ["pull", "resolve"]
    dns_servers = ["192.168.1.53"]