Resolver: add mTLS support

[mironovgh]

The registry resolver does not currently apply custom TLS settings to mirror connections, preventing access to registries that require a custom CA or client authentication.

Add optional per-mirror TLS configuration for custom CA certificates and mTLS client certificate/key pairs. mTLS can be configured alongside the existing resolver mirror configuration, for example:

[resolver]
  [[resolver.host."my.registry.io".mirrors]]
    host = "my.registry.io"
    [resolver.host."my.registry.io".mirrors.tls]
      ca_file = "/etc/ssl/certs/machine-cas.pem"
      cert_file = "/etc/ssl/private/machine-cert-and-key.pem"
      key_file = "/etc/ssl/private/machine-cert-and-key.pem"

---

Test procedure:

1. Enable mTLS via config.toml
2. Restart stargz gRPC service (and, if running, FUSE manager service)
3. Confirm that existing lazy layers recover successfully, perform a manual pull of a lazy image e.g. via nerdctl