agent: investigate support for providing kubelet credential plugin with federated identity support

When accessing ACR outside of Azure, we will very likely need a way to exchange image pull token for the kubelet. We could make sure of a special kubelet cred plugin to support exchaing image pull secret using federated identity.

refs:

- https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/4412-projected-service-account-tokens-for-kubelet-image-credential-providers/README.md
- https://github.com/Azure/msi-acrpull

Start by reading the linked Kubernetes KEP on projected service account tokens for kubelet image credential providers and the Azure/msi-acrpull project. Determine the required approach for exchanging an ACR image pull token for the kubelet through federated identity; done means the support scope and implementation path are established.

Written by the indexing model from the issue text.