k8s: make it easier to portably customise image in ProxyClass

As discussed in https://github.com/tailscale/tailscale/pull/16266#discussion_r2190119532

With the introduction of k8s-proxy, we now have two proxy images the operator may deploy depending on the workload. That makes the `spec.statefulSet.pod.tailscaleContainer.image` field a little awkward because users will have to create a different ProxyClass per image.

There are several approaches we can take to solving this. One is we can allow users to customise the container registry and tag separately from the specific image. So for example you could specify `spec.statefulSet.pod.imageRegistry` as `ghcr.io` (naming/structure tbd) to choose the equivalent images but from ghcr instead of the default Docker hub. We could also repackage containerboot into the k8s-proxy image and just modify the entrypoint based on the workload. And plenty more options too.