Minimally update for the DockerInsecureSkipTLSVerify type change

Following SystemContext.DockerInsecureSkipTLSVerify, make the
DockerRegistryOne also an OptionalBool, and update callers.

Explicitly document that --tls-verify=true and --tls-verify unset
have different behavior in those commands where the behavior changed
(or where it hasn't changed but the documentation needed updating).

Also make the --tls-verify man page sections a tiny bit more consistent
throughout.

This is a minimal fix, without changing the existing "--tls-verify=true"
paths nor existing manual insecure registry lookups.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

cmd/podman/pull.go

@@ -104,11 +104,11 @@ func pullCmd(c *cli.Context) error {
 	}
 
 	dockerRegistryOptions := image2.DockerRegistryOptions{
-		DockerRegistryCreds:         registryCreds,
-		DockerCertPath:              c.String("cert-dir"),
-		DockerInsecureSkipTLSVerify: !c.BoolT("tls-verify"),
+		DockerRegistryCreds: registryCreds,
+		DockerCertPath:      c.String("cert-dir"),
 	}
 	if c.IsSet("tls-verify") {
+		dockerRegistryOptions.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!c.BoolT("tls-verify"))
 		forceSecure = c.Bool("tls-verify")
 	}