use stdlib's x509.SystemCertPool on Windows

[thaJeztah]

relates to:

• Add function to get system cert pool go-connections#21
  • System CA pool excluded when registry CA is used from /etc/docker moby/moby#12756
  • Issue with distribution and /etc/docker not readable moby/moby#15379
• Deprecate tlsconfig.SystemCertPool go-connections#150
• core/remotes/docker: use SystemCertPool on Windows containerd/containerd#13128

use stdlib's x509.SystemCertPool on Windows

The tlsconfig.SystemCertPool utility in go-connections was added in
docker/go-connections@55aadc3, at which time Go stdlib didn't support
system-pools (x509.SystemCertPool) on Windows, so an empty pool was
constructed.

Support for system pools on Windows originally added in Go 1.8 (through
golang/go@05471e9), but reverted, and re-implemented in Go 1.18 (through
golang/go@3544082).

Go 1.18 and up now implement this, but, unlike Linux, which uses a pure-Go
implementation, certificate validation is handled by the system:

On macOS and Windows, certificate verification is handled by system APIs,
but the package aims to apply consistent validation rules across operating
systems.

On macOS and Windows, x509.SystemCertPool returns an empty Pool, with the
systemPool set to true (see loadSystemRoots). This must be considered
an implementation detail; custom CAs can be appended to this pool, and handled
as usual.

This patch removes the special handling on Windows, removing the dependency
on go-connections for this part.

- Human readable description for the release notes

- A picture of a cute animal (not mandatory but encouraged)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/registry/registry.go	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!