rootless: provide workaround for `nerdctl pull 127.0.0.1:5000/foo` 

`nerdctl pull 127.0.0.1:5000/foo` with rootless doesn't work as expected because `pull` occurs in the child namespace.


Needs something like `socat   exec:'containerd-rootless-setuptool.sh nsenter socat "tcp-listen:5000,reuseaddr,fork" "stdio"' tcp-connect:127.0.0.1:5000` (WIP: this exits on HTTP error)