Limit where container based syncs can be sourced from

[patrickdevivo]

Implement a way to “limit” based on a pattern the source of container images for syncs (so that we can only permit syncs from our docker org for example)