Use a lower-privilege Kubelet kubeconfig in system:nodes

[dghubble]

• Kubelets can use a lower-privilege TLS client certificate with Org system:nodes and a binding to the system:node ClusterRole
• Admin kubeconfig's continue to belong to Org system:masters to provide cluster-admin (available in assets/auth/kubeconfig or as a Terraform output kubeconfig-admin)
• Remove bare-metal output variable kubeconfig

Related:

• Add admin kubeconfig and limit Kubelet cert to system:nodes group terraform-render-bootstrap#100
• https://kubernetes.io/docs/reference/access-authn-authz/rbac/#core-component-roles
• Note, this is not implementing NodeAuthorizer and NodeRestriction, those are orthogonal features. Adding those across platforms would effectively require TLS bootstraping, which introduces a runtime dependency on CSR signing (which clashes with CCM) and the question of proper attestation.