Feature: Support authenticated OIDC discovery for Kubernetes-based deployments

**Background:**

When running Vault on Kubernetes, there are two available authentication methods for validating Kubernetes Service Accounts:

* JWT/OIDC authentication method
* Kubernetes authentication method

Both currently require modifications to Kubernetes RBAC configuration:

* JWT/OIDC: Requires making the Kubernetes API server’s OIDC discovery endpoint accessible without authentication.
* Kubernetes: Requires granting Vaults's Service Account permission to call the TokenReview API.

This raises concerns from cluster administrators, who are understandably hesitant to do cluster-wide RBAC changes for any application, especially changes that look like they could reduce the security. As a result, this leads to repeated discussions where the need for these RBAC changes must be justified.

**Feature request:**

The JWT/OIDC authentication method should support authenticating its requests to the Kubernetes API server when fetching the OIDC discovery document and JWKS file.

If Vault can authenticate these requests, it would remove the need for RBAC changes, improving API server security and the experience of running Vault on Kubernetes.