Fetch EKS-A maintained credentials in snow reconciler

**What happened**:

We introduced `identityRef` in Snow provider for CLI: https://github.com/aws/eks-anywhere/pull/3337. But I forgot to update the Snow reconciler code to also fetch the credentials from the EKS-A maintained secret.

**What you expected to happen**:

Instead of fetching the original `capas-manager-bootstrap-credentials` generated from `clusterctl init` in management cluster: https://github.com/aws/eks-anywhere/blob/main/pkg/providers/snow/reconciler/credentials.go#L12, we shall fetch the [EKS-A credential secret](https://github.com/aws/eks-anywhere/pull/3337/files#diff-4adc1c2b956dad1e0c52ab78b7910276d7c3d5a5a3f520e4527a1fdee1749733R176) in `eksa-system` namespace, for controller reconcile.

**How to reproduce it (as minimally and precisely as possible)**:

**Anything else we need to know?**:

**Environment**:
- EKS Anywhere Release:
- EKS Distro Release:

Start with pkg/providers/snow/reconciler/credentials.go and the identityRef change referenced in the issue. Trace how the snow reconciler obtains credentials, then update the source used for controller reconciliation to the EKS-A credential secret in the eksa-system namespace instead of the original clusterctl secret.

Written by the indexing model from the issue text.