[security] default image pull policy

[perdasilva]

Currently, if the unpacker cannot find a policy.json, it defaults to an insecure policy.

We shouldn't silently move to an insecure policy. Maybe this is something that should be configured via command-line flag.

[github-actions]

Issues go stale after 90 days of inactivity. If there is no further activity, the issue will be closed in another 30 days.