[kots]: only add to base image allow list in airgapped mode

[mrsimonemms]

Description

Change the allowlist so it only amends the privateBaseImageAllowList in airgapped mode. As the Replicated proxy URLs were getting added (pointlessly - the base image is never them), this only needs adding for airgapped mode.

docker.io is still added in when in "airgapped mode" as this would be activated if someone is just mirroring their container images (this is possible in KOTS even if the license doesn't allow for airgapped installations).

The codebase in question

How to test

Non Airgapped

• Deploy via KOTS in non-airgapped mode
• Run kubectl get configmaps -n gitpod gitpod -o jsonpath='{.data.config\.yaml}'
• Should see the following:

containerRegistry:
  privateBaseImageAllowList: []

Airgapped

• Deploy via KOTS in airgapped mode
• Run kubectl get configmaps -n gitpod gitpod -o jsonpath='{.data.config\.yaml}'
• Should see the following:

containerRegistry:
  privateBaseImageAllowList:
  - <airgapped-hostname>
  - docker.io

Release Notes

[kots]: add docker.io to registry allowlist

Documentation

Werft options:

• /werft with-preview

[mrzarquon]

This looks good for now - we need to decide how to handle defaultbaseimage / expose it better as a setting (see also: workspace-base as default in the future -> #10359 ) but since we know docker.io/gitpod/workspace-full:latest is our current defaultbaseimage, it should be allowed