Restructure k8schain imports

We do side-effectual imports in k8schain to pull in cloud-specific credential providers. We currently have build tags to disable importing specific things in k8schain. This seems backwards.

Callers should be responsible for importing these magic packages, not k8schain, which would make the dependency graph a little less stupid.

Start at the k8schain entry point and trace its side-effect imports, build-tag exclusions, and callers that rely on cloud-specific credential providers. Done means the dependency responsibility is moved to callers without k8schain-owned magic imports, with the affected import paths and build configurations still working.

Written by the indexing model from the issue text.