Convert RKE2 registries to hiera-driven template, disable default endpoints

- Replace static registries.yaml with EPP template driven by rke2::registries hash
- Add disable-default-registry-endpoint: true to all mirrors
- Registry configuration now managed via hiera data in roles/infra/k8s.yaml

modules/rke2/manifests/params.pp

@@ -13,4 +13,5 @@ class rke2::params (
   Array[String[1]]        $extra_config_files = [],
   Stdlib::HTTPUrl         $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
   Boolean                 $manage_registries = false,
+  Hash                    $registries = {},
 ) {}