ImagePullSecrets in actor templates

Right now, you can only auth to google artifact registry. We should add support for pulling from arbitrary private registry with `ImagePullSecrets` on the ActorTemplate. I think the main question is who should resolve the secret? Atelet or ate-api. I'm leaning towards `atelet` much like how kubelet resolve's secret. This however does put a kube apiserver call in the golden image creation path, which is probably fine. Also, we can add a secret cache since I would guess that there aren't that many image pull secrets in a cluster.

The one thing to watch out for is that the atelet kubernetes service account is going to need configuration to access the referenced secrets.