[stub] issue short lived identites using the CSR API

Is your feature request related to a problem? Please describe.

Stop borrowing the signing key from KCM. Support OpenShift, AKS, GKE, etc without using the impersonation proxy.

Describe the solution you'd like

Starting in v1.22 the CSR API has the spec.expirationSeconds field which can be used to request a short lived certificate (as low as 10 mins). We should be able to detect if the API server and signer support this functionality and use it instead of trying to borrow the KCM signer key.

Describe alternatives you've considered

N/A

Are you considering submitting a PR for this feature?

• How will this project improvement be tested?
  • Unit and integration tests across multiple cluster types
• How does this change the current architecture?
  • Removes a significant hack from pinniped
• How will this change be backwards compatible?
  • It is backwards compatible but does increase certs from 5 mins to a 10 min lifetime
• How will this feature be documented?
  • There might be docs related to when the impersonation proxy is needed vs not

Additional context

1. We should make sure the KCM signing key borrowing deployment is cleaned up
2. Changes to the credential issuer status may be tricky to get correct

Start by reading the Kubernetes CSR API's spec.expirationSeconds behavior and tracing Pinniped's KCM signing key borrowing and credential issuer status paths. Verify support detection and backward-compatible fallback across cluster types with unit and integration tests. Done means short-lived certificates are used when supported and the signing-key borrowing deployment is cleaned up.