CRI today uses a mix of the containerd client to pull images alongside a plugin specific implementation. The transfer service pull operation should replace this logic and be able to take advantage of all new features added to the transfer store, such as sandboxed unpacking, credential helpers, and image validation.

CRI specific configuration around pull will need to be migrated to the transfer service. Ideally the configuration can either be directly translated or explicitly migrated if needed. The mirror configuration is always moved to a new configuration method which makes some of this easier.

Related to #7592