Add registry pull through cache support

As a company concerned with reproducibility of my Spacelift stack runs, I would like to be able to setup a “pull through cache” style capability on my private registry. The behavior should be similar to AWSs ECR feature (https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html).

Ideally I would be able to point at up an upstream provider via my private registry through a mapping of provider and namespace to path within our registry.
For bonus points and to enable very security concerned customers, this feature should also enable policies and those policies should allow the organization to express which versions and external registries should be allowed to be automatically pulled through/updated.