feat(ske): support stateless WIF kubeconfig login

[Galin-Karabadzhakov]

Description

Enable stackit ske kubeconfig login --idp to operate as a stateless Kubernetes exec credential provider using STACKIT Workload Identity Federation.

Kubernetes clients do not always include cluster information in KUBERNETES_EXEC_INFO, and in-cluster workloads should not require persisted CLI credentials or cache state.

This change:

• Adds explicit cluster and organization flags as fallbacks when exec cluster information is omitted.
• Uses the existing global project and region configuration.
• Automatically detects the projected SKE workload identity token or STACKIT_FEDERATED_TOKEN_FILE.
• Obtains a STACKIT access token through the SDK WIF flow.
• Exchanges the access token for an SKE cluster IdP token without requiring authentication storage.
• Supports stateless authentication through STACKIT_ACCESS_TOKEN.
• Preserves existing kubeconfig and cache behavior for non-stateless authentication.
• Adds documentation and unit coverage for the new flows.

Relates to #1327.

This is complementary to #1424, which introduces general WIF authentication support.

Validation

• make fmt
• make generate-docs
• make lint
• make build
• go test ./internal/pkg/auth ./internal/cmd/ske/kubeconfig/login
• Live SKE validation using a projected workload identity, read-only root filesystem, and no persisted home directory

The repository-wide make test currently reports two unrelated failures that were reproduced on an unchanged main checkout.

Checklist

• Issue was linked above
• Code format was applied: make fmt
• Examples were added or adjusted
• Docs are up-to-date: make generate-docs
• Unit tests were implemented or updated
• Affected unit tests are passing
• No linter issues: make lint

[github-actions]

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

[Galin-Karabadzhakov]

Hi team, could you please confirm whether this approach aligns with the intended direction for non-interactive SKE authentication?
I have validated the implementation with workload identity federation and credential renewal in a Kubernetes exec credential flow. It allows stateless, short-lived authentication without storing bearer tokens or service-account keys.
If a different command structure or authentication integration is preferred, I would be happy to adjust the implementation. A brief direction from the maintainers would help us move this forward and avoid duplicating functionality outside the CLI.