Tweak SDK Container insecure registry support to allow subdomains

### Is your feature request related to a problem? Please describe.

Right now users can configure insecure registries in their container engine (docker, podman) or via the `SDK_CONTAINER_INSECURE_REGISTRIES` environment variable. The current implementation checks any host requested against the set of insecure registries, and if a match is made configures HttpClient to [accept any valid certificates that match for the host exactly](https://github.com/dotnet/sdk/blob/a831327451798202104bc2b288220a12fa3a66c1/src/Containers/Microsoft.NET.Build.Containers/Registry/DefaultRegistryAPI.cs#L81-L98).

This doesn't handle scenarios where a request for manifest data, configs, or blobs is served by a different sub-domain from the parent domain, for example very simple pulls from `mcr.microsoft.com`.

### Describe the solution you'd like
I propose that the existing insecure registry support be expanded to allow requests under that domain, and potentially allow any url that any request to that domain may specify. For example, requesting a blob may direct the client to download the content from a completely different domain - I think we should support this by dynamically altering the set of domains allowed to be accessed regardless of TLS configuration.

cc @tmds for thoughts