Add a new native function that resolves docker image names into more
specific forms.  In particular, it can look up a docker registry and
convert image:tag to image@digest at jsonnet-eval time.

Limitations: Does not currently support private docker
registries (that require authentication).

Controlled via two new command line flags:
- `--resolve-images` Change implementation of resolveImage native
  function. One of: noop, registry (default "noop")
- `--resolve-images-error` Action when resolveImage fails. One of
  ignore,warn,error (default "warn")

Note in particular that the defaults will *not* do remote registry
lookups, and will only add an explicit ":latest" tag where no tag was
given.

Fixes #13