[deckhouse] fix: registry client

[timmilesdw]

Description

Fixed the --insecure flag in the registry client. The flag was being unconditionally reset to false in NewClientWithOptions, preventing HTTP connections to insecure registries.

Changes:

• Removed the line that reset opts.Insecure = false in NewClientWithOptions
• Added insecure field to the Client struct to preserve the flag across operations
• Added nameOptions() helper method that returns name.Insecure option when the client is configured for HTTP
• Updated all name.ParseReference() calls (7 locations) to use nameOptions() for proper HTTP/HTTPS scheme handling
• Added comprehensive unit tests covering insecure flag behavior, scheme handling, and transport configuration

Why do we need it, and what problem does it solve?

Users need to connect to container registries over HTTP (without TLS) in development environments, air-gapped installations, and when working with local registries. The --insecure flag was being ignored due to a bug that unconditionally reset it to false, causing all registry connections to attempt HTTPS regardless of user configuration. This made it impossible to use the mirror push/pull commands with insecure registries.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: deckhouse-controller
type: fix
summary: Fixed `--insecure` flag being ignored in registry client operations
impact_level: default