Mirror repository rewrites (v1.1)

Support CRI configuration to allow for request-time rewrite rules
applicable only to the repository portion of resource paths when pulling
images. Because the rewrites are applied at request time, images
themselves will not be "rewritten" -- images as stored by CRI (and the
underlying containerd facility) will continue to present as normal.

As an example, if you use the following config for your containerd:
```toml
[plugins]
  [plugins."io.containerd.grpc.v1.cri"]
    [plugins."io.containerd.grpc.v1.cri".registry]
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ["https://registry-1.docker.io/v2"]
       	  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io".rewrite]
            "^library/(.*)" = "my-org/$1"
```

And then subsequently invoke `crictl pull alpine:3.13` it will pull
content from `docker.io/my-org/alpine:3.13` but still show up as
`docker.io/library/alpine:3.13` in the `crictl images` listing.

This commit has been reworked from the original implementation. Rewites
are now done when resolving instead of when building the request, so
that auth token scopes stored in the context properly reflect the
rewritten repository path. For the original implementation, see
06c4ea9baec2b278b8172a789bf601168292f645.
Ref: https://github.com/k3s-io/k3s/issues/11191#issuecomment-2455525773

Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

core/remotes/docker/resolver.go

@@ -27,6 +27,7 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"regexp"
 	"strings"
 	"sync"
 
@@ -239,14 +240,13 @@ func (r *dockerResolver) Resolve(ctx context.Context, ref string) (string, ocisp
 	if err != nil {
 		return "", ocispec.Descriptor{}, err
 	}
-	refspec := base.refspec
-	if refspec.Object == "" {
+	if base.refspec.Object == "" {
 		return "", ocispec.Descriptor{}, reference.ErrObjectRequired
 	}
 
 	var (
 		paths [][]string
-		dgst  = refspec.Digest()
+		dgst  = base.refspec.Digest()
 		caps  = HostCapabilityPull
 	)
 
@@ -264,7 +264,7 @@ func (r *dockerResolver) Resolve(ctx context.Context, ref string) (string, ocisp
 		paths = append(paths, []string{"blobs", dgst.String()})
 	} else {
 		// Add
-		paths = append(paths, []string{"manifests", refspec.Object})
+		paths = append(paths, []string{"manifests", base.refspec.Object})
 		caps |= HostCapabilityResolve
 	}
 
@@ -273,11 +273,6 @@ func (r *dockerResolver) Resolve(ctx context.Context, ref string) (string, ocisp
 		return "", ocispec.Descriptor{}, fmt.Errorf("no resolve hosts: %w", errdefs.ErrNotFound)
 	}
 
-	ctx, err = ContextWithRepositoryScope(ctx, refspec, false)
-	if err != nil {
-		return "", ocispec.Descriptor{}, err
-	}
-
 	var (
 		// firstErr is the most relevant error encountered during resolution.
 		// We use this to determine the error to return, making sure that the
@@ -296,7 +291,11 @@ func (r *dockerResolver) Resolve(ctx context.Context, ref string) (string, ocisp
 	for _, u := range paths {
 		for i, host := range hosts {
 			ctx := log.WithLogger(ctx, log.G(ctx).WithField("host", host.Host))
-
+			base := base.withRewritesFromHost(host)
+			ctx, err = ContextWithRepositoryScope(ctx, base.refspec, false)
+			if err != nil {
+				return "", ocispec.Descriptor{}, err
+			}
 			req := base.request(host, http.MethodHead, u...)
 			if err := req.addNamespace(base.refspec.Hostname()); err != nil {
 				return "", ocispec.Descriptor{}, err
@@ -501,7 +500,6 @@ func (r *dockerBase) request(host RegistryHost, method string, ps ...string) *re
 	if header == nil {
 		header = http.Header{}
 	}
-
 	for key, value := range host.Header {
 		header[key] = append(header[key], value...)
 	}
@@ -519,6 +517,28 @@ func (r *dockerBase) request(host RegistryHost, method string, ps ...string) *re
 	}
 }
 
+func (r *dockerBase) withRewritesFromHost(host RegistryHost) *dockerBase {
+	for pattern, replace := range host.Rewrites {
+		exp, err := regexp.Compile(pattern)
+		if err != nil {
+			log.L.WithError(err).Warnf("Failed to compile rewrite, `%s`, for %s", pattern, host.Host)
+			continue
+		}
+		if rr := exp.ReplaceAllString(r.repository, replace); rr != r.repository {
+			log.L.Debugf("Rewrote repository for %s: %s => %s", r.refspec, r.repository, rr)
+			return &dockerBase{
+				refspec: reference.Spec{
+					Locator: r.refspec.Hostname() + "/" + rr,
+					Object:  r.refspec.Object,
+				},
+				repository: rr,
+				header:     r.header,
+			}
+		}
+	}
+	return r
+}
+
 func (r *request) authorize(ctx context.Context, req *http.Request) error {
 	// Check if has header for host
 	if r.host.Authorizer != nil {