Embed an opt-in default source policy for Docker-managed frontend images.
Load it ahead of user policies when enabled, and cover behavior with table-
driven policy tests for signed, unsigned, floating, and labs tags.
Makes sure if there is any attack against the docker/dockerfile
releases, or they accidentally point to worng images, these are automatically detected.
In a future release these should become opt-out.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
