Description

This story covers supporting TLS in containerd's mirror registry config. Users may use registries that require TLS verification as mirrors –

1. we should import all user provided certificates (through "user-ca-bundle" configmap or additionalTrustBundle field in install config) to the Windows nodes regardless of cluster settings
   1. We are currently missing certs provided through additionalTrustBundle field in install config, these are not injected into the ProxyCertsConfigMap that WMCO watches
   2. This is done today only when proxy is enabled
2. the containerd hosts files should point mirrors to use the certificate bundle 

Acceptance Criteria

• User custom certs for image registries are imported onto Windows nodes
• containerd uses these certs when pulling from mirror repos
• Disconnected CI job does not hit TLS error when pulling Windows images
• write docs calling out disconnected/image mirroring support - previous "docs"
• mark disconnected job as required