refactor: configure kubelet serving certificate rotation label at runtime

[cameronmeissner]

What type of PR is this?

What this PR does / why we need it:

this PR moves the logic which adds the special kubernetes.azure.com/kubelet-serving-ca=cluster label out of agentbaker and directly into provisioning scripts - this is primarily to ensure that we preserve this functionality when using scriptless, and there is no agentbakersvc

Which issue(s) this PR fixes:

Fixes #

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• tested upgrade from previous version

Special notes for your reviewer:

Release note:

none

[AbelHu]

LGTM. Thanks for the PR.

[lilypan26]

is it safe to remove the equivalent logic from baker.go files? Or do we still need it there as well

[cameronmeissner]

is it safe to remove the equivalent logic from baker.go files? Or do we still need it there as well

we need to keep it in there for now since we can't release everything at once for windows (they need to create a new script package before we can start calling new functions from within the primary CSE scripts)

I'll follow-up and remove that logic once windows has everything released