Ability to exclude images from ImagesLock

**Describe the problem/challenge you have**
I'm using `kbld` to generate an ImagesLock file for use with `imgpkg`, as outlined in https://carvel.dev/imgpkg/docs/latest/air-gapped-workflow/. But not every image should be part of the resulting imgpkg bundle, specifically any images that will be available behind the airgap. For such images, including them
would at best be wasteful.

Even worse, sometimes images will be available at runtime, and so don't need to be in the imgpkg bundle, but _won't_ be available at build time. For example, you may not have permission to access a registry at build time, but do at runtime.

The current recommended solution is to remove any images you don't want from the ImagesLock file. But this requires that your bundling code know about such images.

**Describe the solution you'd like**
Ability to specify via an annotation that a pod's image(s) should be excluded from an ImagesLock file.

Care would have to be taken to handle omitting a subset of a pod's images in the case where a pod has multiple container images.

**Anything else you would like to add:**
Slack discussion: https://kubernetes.slack.com/archives/CH8KCCKA5/p1630616269091900

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.