Problems migrating to config version 3 when using configs."my.custom.registry".tls and configs."my.custom.registry".auth

### Description

In configurations that use both options at the same time:

```
configs."my.registry".tls
configs."my.registry".auth
```

it is not possible to migrate to version 3 config.

- If will migrate to config v3 and start using [Registry Host Config](https://github.com/containerd/containerd/blob/main/docs/hosts.md#registry-configuration---examples) :

```
[root@dev-master-0 ~]# cat /etc/containerd/certs.d/_default/hosts.toml

[host."https://my.registry"]
ca = "/opt/share/ca-certificates/my.registry-ca.crt"
```

we will lose the ability to use auth-tokens for authentication in registry.

- If we continue to use config version 2 with containerd v2.*, we lose the ability to set a custom CA for the registry (containerd returns an error that the key does not exist):

```
root@test-vm:~# containerd -c /etc/containerd/config.toml
INFO[2025-03-31T07:33:22.854396613Z] starting containerd revision=1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20 version=v2.0.4
WARN[2025-03-31T07:33:22.861995250Z] Configuration migrated from version 2, use `containerd config migrate` to avoid migration t="20.571µs"
....
INFO[2025-03-31T07:33:22.868476817Z] loading plugin id=io.containerd.cri.v1.images type=io.containerd.cri.v1
WARN[2025-03-31T07:33:22.868686115Z] Ignoring unknown key in TOML for plugin error="strict mode: fields in the document are missing in the target struct" key="registry configs my.registry tls" plugin=io.containerd.cri.v1.images
```

Alternatively, CA certificates can be added to the system, but this solution is not suitable in our cases.

### Steps to reproduce the issue

1. copy/paste config to /etc/containerd/config.toml
2. `containerd -c /etc/containerd/config.toml config migrate` or run containerd
3. get error:
```
WARN[0000] Ignoring unknown key in TOML for plugin error="strict mode: fields in the document are missing in the target struct" key="registry configs my.registry tls" plugin=io.containerd.cri.v1.images
```

### Describe the results you received and expected

Ability to migrate to containerd v2 using auth tokens and specifying tls parameters for registry.

### What version of containerd are you using?

containerd github.com/containerd/containerd/v2 v2.0.4 1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20

### Any other relevant information

_No response_

### Show configuration if it is related to CRI plugin.

```
disabled_plugins = []
oom_score = 0
plugin_dir = ""
required_plugins = []
root = "/var/lib/containerd"
state = "/run/containerd"
version = 2

[cgroup]
path = ""

[debug]
address = ""
gid = 0
level = ""
uid = 0

[grpc]
address = "/run/containerd/containerd.sock"
gid = 0
max_recv_message_size = 16777216
max_send_message_size = 16777216
tcp_address = ""
tcp_tls_cert = ""
tcp_tls_key = ""
uid = 0

[metrics]
address = ""
grpc_histogram = false

[plugins]
[plugins."io.containerd.gc.v1.scheduler"]
deletion_threshold = 0
mutation_threshold = 100
pause_threshold = 0.02
schedule_delay = "0s"
startup_delay = "100ms"
[plugins."io.containerd.grpc.v1.cri"]
device_ownership_from_security_context = true
disable_apparmor = false
disable_cgroup = false
disable_hugetlb_controller = true
disable_proc_mount = false
disable_tcp_service = true
enable_selinux = false
enable_tls_streaming = false
ignore_image_defined_volumes = false
image_pull_progress_timeout = "5m"
max_concurrent_downloads = 3
max_container_log_line_size = 16384
restrict_oom_score_adj = false
sandbox_image = "registry.k8s.io/pause:3.2"
selinux_category_range = 1024
stats_collect_period = 10
stream_idle_timeout = "4h0m0s"
stream_server_address = "127.0.0.1"
stream_server_port = "0"
systemd_cgroup = false
tolerate_missing_hugetlb_controller = true
unset_seccomp_profile = ""
[plugins."io.containerd.grpc.v1.cri".cni]
bin_dir = "/opt/cni/bin"
conf_dir = "/etc/cni/net.d"
conf_template = ""
max_conf_num = 1
[plugins."io.containerd.grpc.v1.cri".containerd]
default_runtime_name = "runc"
disable_snapshot_annotations = true
discard_unpacked_layers = true
no_pivot = false
snapshotter = "overlayfs"
[plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
base_runtime_spec = ""
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = ""
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
base_runtime_spec = ""
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = "io.containerd.runc.v2"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
SystemdCgroup = false
[plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
base_runtime_spec = ""
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = ""
[plugins."io.containerd.grpc.v1.cri".image_decryption]
key_model = ""
[plugins."io.containerd.grpc.v1.cri".registry]
[plugins."io.containerd.grpc.v1.cri".registry.configs]
[plugins."io.containerd.grpc.v1.cri".registry.configs."my.registry"]
[plugins."io.containerd.grpc.v1.cri".registry.configs."my.registry".auth]
auth = "dG9rZW46cGFzcwo="
[plugins."io.containerd.grpc.v1.cri".registry.configs."my.registry".tls]
ca_file = "/opt/share/ca-certificates/my.registry-ca.crt"
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."my.registry"]
endpoint = ["https://registry.lan"]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
endpoint = ["https://registry-1.docker.io"]
[plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
tls_cert_file = ""
tls_key_file = ""
[plugins."io.containerd.internal.v1.opt"]
path = "/opt/containerd"
[plugins."io.containerd.internal.v1.restart"]
interval = "10s"
[plugins."io.containerd.metadata.v1.bolt"]
content_sharing_policy = "shared"
[plugins."io.containerd.monitor.v1.cgroups"]
no_prometheus = false
[plugins."io.containerd.runtime.v1.linux"]
no_shim = false
runtime = "runc"
runtime_root = ""
shim = "containerd-shim"
shim_debug = false
[plugins."io.containerd.runtime.v2.task"]
platforms = ["linux/amd64"]
[plugins."io.containerd.service.v1.diff-service"]
default = ["walking"]
[plugins."io.containerd.snapshotter.v1.devmapper"]
async_remove = false
base_image_size = ""
pool_name = ""
root_path = ""

[timeouts]
"io.containerd.timeout.shim.cleanup" = "5s"
"io.containerd.timeout.shim.load" = "5s"
"io.containerd.timeout.shim.shutdown" = "3s"
"io.containerd.timeout.task.state" = "2s"

[ttrpc]
address = ""
gid = 0
uid = 0
```