feat(imds): add IMDS client wrapper with 20 TPS rate limiter

[gargipanatula]

Note - originally approved by a-cool-train@ and DanielCKennedy@ here but we are doing fresh PRs to merge into main. There are no changes from that PR.

Adds an IMDS delegate, similar to the EKS Auth delegate in that it fetches credentials from a source via GetIamCredentials. The delegate:

• Reads pod creds from IMDS namespaces prefixed with iam-eks-N (N for an indeterminate amount of namespaces)
  • Discovered by listing /latest/meta-data and filtering for iam-eks prefix
• Maintains a map of podUID -> namespace for easy lookup during retrieval
  • Built at startup, and refreshed in the background every minute
• IMDS client is rate limited at 20 TPS as to not overwhelm other node processes

This delegate isn't referenced by the handler yet, so there's no runtime behavior change.

Testing: make build and make test green
Some new tests to highlight:

• TestNamespaceMapping_Build
  • Ensures agent can handle empty, partial, and malformed namespaces while still parsing good data and not crashing any processes
• TestNamespaceMapping_BackgroundRefresh_UpdatesMap + TestNamespaceMapping_Stop_HaltsRefresh
  • Ensures that map stays fresh as pods shuffle across namespaces
• TestGetIamCredentials
  • When a pod is in the mapping, the credential is returned (happy)
  • When a pod is not in the mapping, it returns "not found"
  • When a credential is not in IMDS, again returns "not found"
  • Ensures expired creds are still returned (IMDS creds may be statically stable)
  • Ensures that invalid tokens return an error before IMDS calls are made
• E2E testing
  • Builds fake IMDS client, tests that the map gets build and the creds can be retrieved