[ECR] [request]: Support for unauthenticated generic ECR pull-through cache

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

I want you to support pulling from any 3rd party registry unauthenticated.
This is needed because many helm releases today provide images which are hosted outside registries supported by the ECR pull-through cache.

To us this is needed for making k8s operations stable as you might need external registries like l5d.io and others not supported by ECR yet.

**Which service(s) is this request for?**

ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

We experience from time to time that external images are not able to be pulled because their service is not available, or rate limits have been hit.
Some of these external registries are not currently supported by ECR proxy and we would therefore need to setup some automation to keep images that we use in our registry.

This is however a lot of work which is possible to fail, rather than just being able to pull something generic from it.
I envision that you'd be able to pull an image which today would be called something like:

```
external.registry.com/image:version
```

To be pulled with something like:

```
/proxy/external.registry.com/image:version
```

None of these images we are using require authentication and this is therefore not needed for this request.

**Are you currently working around this issue?**

we're looking into using [kube-image-keeper](https://github.com/enix/kube-image-keeper)

**Additional context**
I'm prettry sure that this is somehing supported by artifactory today and kube-image-keeper.

**Attachments**

Start by reviewing the ECR pull-through cache behavior described in the issue and the kube-image-keeper workaround. Define how an unauthenticated external.registry.com/image:version request would map to ECR, including unsupported third-party registries; done means external images can be pulled through ECR without authentication.

Written by the indexing model from the issue text.