feat: initial image cred plugin integration

[porridge]

This change enables basic kubelet credential provider plugin integration.

• deploy has a new flag --use-kubelet-image-credential-integration=MODE which in turns causes the prefetcher deployment to mount config and plugin binaries from the host.
• If configured, plugin credentials are fetched dynamically and tried for the images configured in the CredentialProviderConfig before pull secrets.
• tested in fix(ci): work around preloaded image use problem in recent k8s stackrox#19287

Caveats:

• Currently only supports mode GKE, which uses /etc/srv/kubernetes/cri_auth_config.yaml for config and /home/kubernetes/bin for binaries.
• Caching is not considered at all, the plugin is simply executed every time it's needed.

AI-assisted

[mclasmeier]

A high-level PR description would be nice.

[porridge]

A high-level PR description would be nice.

Done.