Support --insecure-registry flag for buildx to avoid changing os ca

I run buildx in DinD, detail:

~ # docker buildx ls
NAME/NODE       DRIVER/ENDPOINT            STATUS  BUILDKIT PLATFORMS
dmcca-builder   remote                                      
  builder-amd64 tcp://192.168.113.10:31108 running v0.11.2  linux/amd64*, linux/amd64/v2, linux/amd64/v3, linux/386
  builder-arm64 tcp://192.168.155.30:30199 running v0.11.2  linux/arm64*
default *       docker                                      
  default       default                    running 23.0.0   linux/amd64, linux/amd64/v2, linux/arm64, linux/riscv64, linux/ppc64le, linux/s390x, linux/386, linux/mips64le, linux/mips64, linux/arm/v7, linux/arm/v6

~ # docker buildx version
github.com/docker/buildx v0.10.2 00ed17df6d20f3ca4553d45789264cdb78506e5f

error detail:

~ # docker buildx build --builder=dmcca-builder --platform=linux/amd64,linux/arm64 --push --progress=plain --provenance=false -t harbor.xxx.io/dmcca/centos:7.9.2009 .
#1 [internal] load .dockerignore
#1 transferring context: 2B done
#1 DONE 0.1s

#2 [internal] load build definition from Dockerfile
#2 transferring dockerfile: 102B done
#2 DONE 0.1s

#3 [internal] load build definition from Dockerfile
#3 transferring dockerfile: 102B 0.0s done
#3 DONE 0.1s

#4 [internal] load .dockerignore
#4 transferring context: 2B done
#4 DONE 0.1s

#5 [linux/amd64 internal] load metadata for docker.io/library/centos:7.9.2009
#5 DONE 0.0s

#6 [linux/amd64 1/1] FROM docker.io/library/centos:7.9.2009@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4
#6 resolve docker.io/library/centos:7.9.2009@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4 done
#6 CACHED

#7 exporting to image
#7 exporting layers done
#7 exporting manifest sha256:28d2568a9de636e4110e476779478d42092f33df9d28e1e11b70325c63a47c17 done
#7 exporting config sha256:547ca5299ddc734f2cc25b375e948b8abdc6e67c8a95f2548c3b365a0e609171
#7 ...

#8 [linux/arm64 internal] load metadata for docker.io/library/centos:7.9.2009
#8 DONE 0.1s

#9 [linux/arm64 1/1] FROM docker.io/library/centos:7.9.2009@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4
#9 resolve docker.io/library/centos:7.9.2009@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4 0.0s done
#9 CACHED

#7 exporting to image
#7 exporting config sha256:547ca5299ddc734f2cc25b375e948b8abdc6e67c8a95f2548c3b365a0e609171 done
#7 exporting manifest list sha256:3e654b06efea19e3cdb8e9f4008c7ad3dab3dac1940cb6dd88585ee42d8cb867 done
#7 pushing layers
#7 pushing layers 0.3s done
#7 ERROR: failed to push harbor.xxx.io/dmcca/centos: failed to authorize: failed to fetch anonymous token: Get "https://harbor.xxx.io/service/token?scope=repository%3Admcca%2Fcentos%3Apull%2Cpush&service=harbor-registry": x509: certificate signed by unknown authority

#10 exporting to image
#10 exporting layers done
#10 exporting manifest sha256:eb2a71089fb84ae64dc212f7ed34c648e4b721fe4b93e71f0cb07ce8bd3a4433 done
#10 exporting config sha256:8a1ba2a79bcec6aa5a1dd7e4730f59108bef65800e32c7ba02959614a18e161e done
#10 exporting manifest list sha256:87d29c0d29332d5ffa6b3b12d11487ad67a83b43424fe71522a6dca9be2fddd9 done
#10 pushing layers 0.1s done
#10 ERROR: failed to push harbor.xxx.io/dmcca/centos: failed to authorize: failed to fetch anonymous token: Get "https://harbor.xxx.io/service/token?scope=repository%3Admcca%2Fcentos%3Apull%2Cpush&service=harbor-registry": x509: certificate signed by unknown authority
------
 > exporting to image:
------
------
 > exporting to image:
------
ERROR: failed to solve: failed to push harbor.xxx.io/dmcca/centos: failed to authorize: failed to fetch anonymous token: Get "https://harbor.xxx.io/service/token?scope=repository%3Admcca%2Fcentos%3Apull%2Cpush&service=harbor-registry": x509: certificate signed by unknown authority

when I add the ca.crt of harbor to /etc/ssl/certs/ca-certificates.crt, everything is worked!

Start at the buildx build command and the remote builder configuration shown in the report; trace where registry certificate verification is handled. Done means the requested --insecure-registry option allows the Harbor push without modifying /etc/ssl/certs/ca-certificates.crt.