feat(ske): support stateless WIF kubeconfig login - #1477

Description

Enable stackit ske kubeconfig login --idp to operate as a stateless Kubernetes exec credential provider using STACKIT Workload Identity Federation.

Kubernetes clients do not always include cluster information in KUBERNETES_EXEC_INFO, and in-cluster workloads should not require persisted CLI credentials or cache state.

This change:

• Adds explicit cluster and organization flags as fallbacks when exec cluster information is omitted.
• Uses the existing global project and region configuration.
• Automatically detects the projected SKE workload identity token or STACKIT_FEDERATED_TOKEN_FILE.
• Obtains a STACKIT access token through the SDK WIF flow.
• Exchanges the access token for an SKE cluster IdP token without requiring authentication storage.
• Supports stateless authentication through STACKIT_ACCESS_TOKEN.
• Preserves existing kubeconfig and cache behavior for non-stateless authentication.
• Adds documentation and unit coverage for the new flows.

Relates to #1327.

This is complementary to #1424, which introduces general WIF authentication support.

Validation

• make fmt
• make generate-docs
• make lint
• make build
• go test ./internal/pkg/auth ./internal/cmd/ske/kubeconfig/login
• Live SKE validation using a projected workload identity, read-only root filesystem, and no persisted home directory

The repository-wide make test currently reports two unrelated failures that were reproduced on an unchanged main checkout.

Checklist

• Issue was linked above
• Code format was applied: make fmt
• Examples were added or adjusted
• Docs are up-to-date: make generate-docs
• Unit tests were implemented or updated
• Affected unit tests are passing
• No linter issues: make lint