Allow custom audience for kubernetes in-cluster joining

[hugoShaka]

This PR removes a common in-cluster joining footgun. Before this PR:

• kubernetes in-cluster required the default kubernetes audience
• kubernetes JWKS required a custom audience (the Teleport cluster name)

Many users mistakenly set the cluster name in the audience for in cluster joining, which caused the joining to fail.

After this PR:

• kubernetes in-cluster accepts the default kubernetes audience AND the teleport cluster name
• kubenetes JWKS requires the Teleport cluster name in the audience

This change does not reduces the security of the join. method and makes the tbot chart compatible with in-cluster joining.

Changelog: Kubernetes in-cluster joining now also accepts tokens whose audience is the Teleport cluster name (before it only allowed the default Kubernetes audience). Kubernetes JWKS joining is unchanged and still requires tokens with the cluster name in the audience.

Internal slack thread that started this PR: https://gravitational.slack.com/archives/C01TYKHFVTQ/p1732733525308779

[timothyb89]

changelog nit:

Changelog: Kubernetes in-cluster joining now also accepts tkoens whose audience is the Teleport cluster name (before it only allowed the default Kubernetes audience).

s/tkoens/tokens, I think?

And to clarify part of the description, JWKS joining behavior is unchanged? It looks like this just adds the Teleport cluster name as a valid audience for in-cluster joining?

[public-teleport-github-review-bot]

@hugoShaka See the table below for backport results.

Branch	Result
branch/v15	Create PR
branch/v16	Create PR
branch/v17	Create PR