Proposal: Custom SpiceDB container registry

[jackwellsxyz]

Some applications require that all images be pulled from a custom container registry, either for vulnerability scanning or for firewall egress reasons. I propose adding an option to spicedb-operator's CRD to allow specifying the registry, which would override the default ghcr.io registry. Supposing the custom registry is public.ecr.aws, a sample image that spicedb-operator would use in a SpiceDB deployment might be public.ecr.aws/authzed/spicedb:v1.39.1.

Here's a SpiceDBCluster with the proposed option:

apiVersion: authzed.com/v1alpha1
kind: SpiceDBCluster
metadata:
  name: test-cluster
spec:
  version: "v1.39.1"
  channel: "stable"
  config:
    datastoreEngine: postgres
  secretName: spicedb-config
  containerRegistry: public.ecr.aws