cri_keychain: preserve access to private registries across restart

[ktock]

Issue

Currently cri keychain holds registry creds only on memory. When stargz-snapshotter restarts, it doesn't have registry creds anymore so it starts to fail to access to the regisry. We should fix this behaviour to prevent issues like #1989 and https://github.com/containerd/stargz-snapshotter/pull/1584#issuecomment-2073686091 .

Current workaround

• A. Use other authentication methods like dockerconfig-based one or kubeconfig-based one that enables the snapshotter to acquire creds during restarting.
• B. Add a configuration to allow stargz-snapshotter to start even with restoration failure:

  [snapshotter]
  allow_invalid_mounts_on_restart = true
  

  Note: the user need to manually remove these (possibly empty) broken images after stargz-snapshotter started, using ctr image rm <image-name>. See also https://github.com/containerd/stargz-snapshotter/pull/901

[dgaponcic]

Hi, are there any updates on this?