Convert RKE2 registries to template, disable default endpoints (#474)

## Summary
- Replace static `registries.yaml` with EPP template driven by `rke2::registries` hash
- Add `disable-default-registry-endpoint: true` to all mirrors — RKE2 will only use artifactapi and never fall back to upstream registries
- Registry configuration now fully managed via hiera data (`roles/infra/k8s.yaml`)

Reviewed-on: #474
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

modules/rke2/manifests/config.pp

@@ -8,6 +8,7 @@ class rke2::config (
   String                  $node_token = $rke2::node_token,
   Array[String[1]]        $extra_config_files = $rke2::extra_config_files,
   Boolean                 $manage_registries = $rke2::manage_registries,
+  Hash                    $registries = $rke2::registries,
 ){
 
   # if its not the bootstrap node, add join path to config
@@ -35,7 +36,7 @@ class rke2::config (
       owner   => 'root',
       group   => 'root',
       mode    => '0644',
-      source  => 'puppet:///modules/rke2/registries.yaml',
+      content => epp('rke2/registries.yaml.epp', { registries => $registries }),
       require => Package["rke2-${node_type}"],
       notify  => Service["rke2-${node_type}"],
     }