UPSTREAM: <carry>: noderestrictions: add node-role.kubernetes.io/* to allowed node labels

Server side validation of node labels was added in kubernetes#90307. We only disabled kubelet-side validation before to make our node role labels work.

openshift-rebase(v1.24):source=6da1c7d4562

Author: sttts

staging/src/k8s.io/kubelet/pkg/apis/well_known_labels.go

@@ -45,6 +45,11 @@ var kubeletLabels = sets.NewString(
 
 	LabelOS,
 	LabelArch,
+
+	// These are special for OpenShift:
+	"node-role.kubernetes.io/master",
+	"node-role.kubernetes.io/worker",
+	"node-role.kubernetes.io/etcd",
 )
 
 var kubeletLabelNamespaces = sets.NewString(