Make CACERTS configurable on the command line

[nnordrum]

If it already is, it serves two masters (which isn't clear).

e.g. better documentation for self-signed certs

[nnordrum]

Update: it makes sense in hind-sight, it's not clear because you're doing one thing at a time, but the self-signed certs for each registry are defined in the registry-config files. If you're using a private cert, you have to add it there for a Dockerfile that uses a FROM command to pull from a registry that has a private cert.

Like I said, obvious in hind-sight, but SUPER confusing at the time :)