[matheuscscp]

Part of: fluxcd/flux2#6103

As a consequence of moving to cryptov1, this PR introduces additional behaviors that did not exist before:

• Awareness to the annotations that overlap with existing spec fields and/or controller flags.
• Various config validations, e.g. custom audiences (from kubeconfig ConfigMap) never worked when the local cluster is GKE, so now we capture the error earlier and make it prettier.
• Splitting audiences by commas. As mentioned in the RFC, this a deliberate hardening choice to avoid common vulnerabilities.
• Credential expiration for KSA tokens from the new annotation.

I'm also adding support in runtime/features to define "retired" feature gates. The controller will now print a log if a retired gate is being used, telling the user that it no longer has any affect and why. This will be used later in Flux 2.11 to retire the gate ObjectLevelWorkloadIdentity, as the feature will become GA and always enabled. Using it will always be opt-in via .spec.serviceAccountName or --default*-service-account + a provider that supports it.

No new service X provider combination is being introduced yet, e.g. no SPIFFE support, no KSA token support for generic registry, etc.

One more hardening I found along the way: all our calls to TokenRequest API now prevent the token from being created with the local cluster's API audiences. All our tokens are for access to external services, not the local Kubernetes cluster.