cherry-pick: refactor: manually generate self-signed kubelet serving cert when opting out of certificate rotation

cherry-pick: refactor: manually generate self-signed kubelet serving cert when opting out of certificate rotation #10585