fix: registry mirror fallback handling

[smira]

Fixes #9613

This has two changes:

• adjust Talos registry resolver to match containerd (CRI) resolver: use by default upstream as a fallback
• add a machine config option to skip upstream as a fallback, and adjust CRI configuration accordingly

See https://github.com/containerd/containerd/blob/main/docs/hosts.md#registry-configuration---examples for details on CRI's hosts.toml.

[smira]

/m