Use tsh as an exec plugin from kubeconfig

[awly]

Feature Request

Instead of writing raw client key/cert into kubeconfig on tsh login, generate an exec plugin section.
This will cause kubectl to execute tsh (with configurable flags or env vars) to fetch the client key/cert.
tsh should have some helper logic to generate that exec section in kubeconfig and also prompt login if credentials have expired.

Motivation

1. when user's credentials expire today, the user gets obscure x509 errors from kubectl; with exec plugin this can be changed to a login prompt or at least a helpful error message.
2. if a user only works with a fixed set of k8s clusters, they don't need to interact with tsh at all after initial setup.

Who's it for?

OSS User, Pro, Enterprise

cc @webvictim @benarent

[awly]

#3690 is a good approximation of the UX we expect.
Read through that implementation before starting to learn any gotchas.