Make docker container runtime a first-class citizen

[BeckerMax]

What would you like to be added:

• Read list of supported runtimes from CloudProfile only, don't add docker to the list of available container runtimes for a MachineImageVersion
• When docker is selected, set cri.name=docker explicitly, don't leave cri=nil
• This concerns both aspects: adding a new cluster and/or worker pool as well as modifying an existing worker pool
• Notice to the release notes that open-source users have to adapt their CloudProfile to explicitly add docker to all MachineImageVersions which support it.

Why is this needed:
In the context of deprecating the in-tree dockershim, we're making a few changes to g/g, which will result in shoots with k8s version >=1.22 getting containerd as container runtime when cri=nil:

• As a user, I want to be able to explicitly configure docker as a container runtime, such that I can switch back to docker when I find out my workload doesn't run nicely on containerd: Allow selecting docker as cri.name gardener#4218
• As a gardener operator, I want new shoots to be created with containerd as a default container runtime, such that users no longer get shoots using deprecated functionality: Set containerd as default container runtime for k8s>=1.22 gardener#4222

Note
Prerequisites for this change are

• As a user, I don't want a node rollout to happen when my configuration change is essentially a no-op, such that I don't suffer from unnecessary downtime (cases: explicitly specifying docker when previously created with docker as implicit default): Enh/stable worker hash gardener#4237
• Adapting the CloudProfile as mentioned above before deploying

This is a prerequisite for releasing a g/g version which supports k8s 1.22 (earliest in August).

cc @voelzmo