feat(container-registry): add configurable capabilities to RegistryMirrorV1

## Summary

`RegistryMirrorV1` currently has no `capabilities` field. The only consumers of this model (`thar-be-registries` in `bottlerocket-core-kit`) hardcode `["pull", "resolve"]` for all mirror endpoints.

This blocks tools like [Spegel](https://github.com/spegel-org/spegel) that require `["pull"]`-only mirrors. containerd 2.1's transfer service fails when Spegel's DHT hasn't initialized if `resolve` is also requested.

See the upstream issue: bottlerocket-os/bottlerocket#4710

## Proposed change

Add a `RegistryMirrorCapabilityV1` enum (`pull`, `resolve`, `push`) and an optional `capabilities` field to `RegistryMirrorV1`:

```rust
capabilities: Vec,
```
When absent (`None`), consumers default to `["pull", "resolve"]` for backward compatibility. Unknown values are rejected at serde deserialization time.

I have a PR ready to submit.

Locate the RegistryMirrorV1 model and its serde definitions, then inspect how optional fields and enum values are represented. Add the RegistryMirrorCapabilityV1 variants and the optional capabilities field described in the issue, preserving the documented default behavior and rejection of unknown values; done means the model supports pull, resolve, and push capabilities without breaking existing consumers.

Written by the indexing model from the issue text.