move registry custom resource to be cluster scoped

[bparees]

Since we only want one registry per cluster anyway (can't actually tolerate more than one) and because finalizers deadlock themselves when the finalizer and the resource being finalized run in the same namespace, we need to switch the registry resource CRD to be cluster scoped instead of namespace scoped.

/cc @deads2k

/assign @legionus