As a Quay user I want to be able to proxy images through Quay orgs

Acceptance criteria

• As a user I can pull an image from Quay from a proxy organization even if it doesn't exist there yet. [NOTE: this is a partial user story taken from the PROJQUAY-465 epic and it leaves out the caching bits. Storage (cache) will be covered on a different ticket, which will be linked to this one once created.]
• As a Quay user I want to be able to supply credentials to the upstream registry so that I can circumvent / extend possible pull-rate limits or access private repositories
• As a user I want to be able to use the cache explicitly by referring to the upstream images by their original path components that are simply appended to URL of the quay cache location e.g. docker.io/library/postgres:latest -> quay.corp/cache/library/postgres:latest
• Assuming that many existing customers with strong governance requirements explicitly do not want to offer this capability but use the explicit whitelisting via repo mirroring instead the feature need to be configurable (globally on or off) via config file / app.

Open questions

• Technically speaking, we don't need to have a different pull endpoint for cached images. Is this acceptable from a user perspective?
  • There is no separate endpoint for cache. The quay.corp/cache/library/postgres:latest example uses a nested repository name, and cache is the org name.