cri_keychain: preserve access to private registries across restart

[ktock]

Issue

Currently cri keychain holds registry creds only on memory. When stargz-snapshotter restarts, it doesn't have registry creds anymore so it starts to fail to access to the regisry. We should fix this behaviour to prevent issues like #1989 and #1584 (comment) .

Current workaround

• A. Use other authentication methods like dockerconfig-based one or kubeconfig-based one that enables the snapshotter to acquire creds during restarting.
• B. Add a configuration to allow stargz-snapshotter to start even with restoration failure:

  [snapshotter]
  allow_invalid_mounts_on_restart = true
  

  Note: the user need to manually remove these (possibly empty) broken images after stargz-snapshotter started, using ctr image rm <image-name>. See also Allow manually remove invalid snapshots on restore #901