Kubernetes service watcher is always enabled, no matter the template used

### Description

Reviewing process' running inside a Lima Ubuntu VM, I was tracking down why I was seeing several repeated calls to a development server running in port `8080`. Following my process tree up I found it was the guest agent's Kubernetes watcher continuously running `kubectl auth can-i get service` and hitting my unrelated development server running on port 127.0.0.1:8080 as that's the default address `kubectl` will hit if no config exists. https://github.com/lima-vm/lima/blob/master/pkg/guestagent/guestagent_linux.go#L31-L35

When running a VM with a Kubernetes master node on it, I can understand the usefulness of this feature, but using any non-container based template image it feels wrong having it loop and fail. Or worse when you start a dev server on 8080 and wonder why something is trying to access the Kubernetes API. :P

Would it be better if this service in the guest agent only started if a configuration in the template enabled it? I don't see an obvious config option at the moment looking through the docs and examples.