Clarify which credentials plugins should use to access Kubernetes clusters

While implementing the Secret Reader plugin, I noticed that it is unclear which credentials a plugin should use to access a Kubernetes cluster:

1. Load from the environment
2. Use `cp-creds.json`
3. Be explicitly provided by the controller using the plugin

Currently, the KEP does not provide guidance on this.
I believe it would be helpful to clarify the expected approach and, if necessary, add supplementary notes to the KEP.

Related PR: [https://github.com/kubernetes-sigs/cluster-inventory-api/pull/21](https://github.com/kubernetes-sigs/cluster-inventory-api/pull/21)

Start by reading the KEP and the related PR #21, focusing on the Secret Reader plugin and the three credential sources listed in this issue. Clarify the expected credential approach for plugins accessing Kubernetes clusters, then add supplementary guidance to the KEP and verify that it resolves the ambiguity.

Written by the indexing model from the issue text.