Update ClusterLoader2's temp KubeConfig PKI for ServiceAccount

[sambdavidson]

Populating a ServiceAccount's Secret with CA and JWT data is a legacy flow replaced in 1.24+ with the kube-root-ca.crt ConfigMap and token resources. Public documentation now encourages using tokens instead: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#manual-secret-management-for-serviceaccounts

What type of PR is this?

/kind bug
/kind deprecation

What this PR does / why we need it:

Which issue(s) this PR fixes:

Clusters using GKE's CPA (and many other modern clusters) no longer populate a SA's secret with CA and token information.

Special notes for your reviewer:

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sambdavidson
Once this PR has been reviewed and has the lgtm label, please assign marseel for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• clusterloader2/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wojtek-t]

/assign @jprzychodzen @tosi3k

[jprzychodzen]

I'm not exactly following why we should use another way.

Per upgrade notes (I guess it strictly related to kubernetes/kubernetes#108309) we are creating a Service account, as per linked documentation https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets and https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-long-lived-api-token-for-a-serviceaccount .

Could you elaborate why it's considered legacy?