restricts the accessible set of images when using proxy caches

Limit the images that can be pulled from a remote registry when using proxy caches.

Upstream ticket: https://github.com/goharbor/harbor/issues/13231