Document the need to use a PAT with Registry when 2FA is on

GitLab 8.12 introduced a new permissions model which tightened the
security of Container Registry. It is now required to use a personal
token if 2FA is enabled.

[ci skip]