sagemaker: Support container images from private Docker registries

### Describe the feature

As described in [the SageMaker `Endpoint` L2 construct RFC](https://github.com/aws/aws-cdk-rfcs/blob/master/text/0431-sagemaker-l2-endpoint.md#feature-additions):

> [Private Docker Registries][private-docker]: The `ImageConfig` type was added to the existing `ContainerDefinition` CloudFormation structure in order for customers to specify that a VPC-connected Docker registry will act as the source of the container's image (as opposed to ECR which acts as the default platform repository). This new type also contains an optional `RepositoryAuthConfig` nested structure in order to specify the ARN of a Lambda function capable of serving repository credentials to SageMaker.

[private-docker]: https://aws.amazon.com/about-aws/whats-new/2021/03/amazon-sagemaker-now-supports-private-docker-registry-authentication/

**Please 👍 this issue to help with the prioritization of this feature.**

### Use Case

Some customers may prefer to host images within a private Docker registry (rather than the currently supported ECR).

### Proposed Solution

As described in [the SageMaker `Endpoint` L2 construct RFC](https://github.com/aws/aws-cdk-rfcs/blob/master/text/0431-sagemaker-l2-endpoint.md#feature-additions):

> In order to deliver this functionality in a backward-compatible way, inspiration can be taken from [ECS's `ContainerImage.fromRegistry` API][container-image-from-registry] (note though, ECS sources credentials from Secrets Manager rather than Lambda) in order to make the following additions to the SageMaker module:
>
> 1. Add attributes to `ContainerImageConfig` to support the specification of a non-platform repository along with an optional Lambda function ARN.
> 1. Implement a new, non-exported `RegistryImage` subclass of `ContainerImage` whose constructor takes an optional Lambda `IFunction` instance for generating a `ContainerImageConfig` instance with the appropriate Lambda function ARN for serving credentials.
> 1. On `ContainerImage`, add a new static `fromRegistry` method which takes a props object consisting of an optional Lambda `IFunction` instance. This method acts as a simple static factory method for the non-exported `RegistryImage` class.

### Other Information

_No response_

### Acknowledgements

- [ ] I _may_ be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.54.0-alpha.0

### Environment details (OS name and version, etc.)

macOS Ventura

Start with the SageMaker Endpoint L2 construct RFC and inspect the existing ContainerImage and ContainerDefinition APIs, including the ECS ContainerImage.fromRegistry precedent. The work is done when ContainerImage supports the proposed fromRegistry factory and RegistryImage behavior, and ImageConfig can represent a private registry with optional Lambda repository authentication.

Written by the indexing model from the issue text.