PCP-6916 : CAPI - Cherry pick upstream PR

[Anusha-sc]

🐛 What this PR does / why we need it

Starting with Kubernetes v1.36, the ControlPlaneKubeletLocalMode feature gate has graduated to GA and no longer needs to be explicitly enabled in kubeadm configurations.

This PR updates CAPI to:

• Only set ControlPlaneKubeletLocalMode for Kubernetes versions >= 1.31 and < 1.36.
• Add unit test coverage verifying the feature gate is not added for Kubernetes v1.36.
• Update KCP adoption e2e tests to remove the feature gate from templates when testing Kubernetes v1.36+.
• Document the behavior change in the version-specific notes.

This ensures generated kubeadm configurations remain compatible with Kubernetes v1.36+, where the feature gate has been removed.

Which issue(s) this PR fixes

Fixes #

/area control-plane
/area testing
/documentation

[bulwark-spectrocloud]

⚠️ GoSec scan found code issues:

1. G115: integer overflow conversion int64 -> int32, Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/cluster/cluster_controller_status.go:107:63
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/cluster/cluster_controller_status.go:104:70
   • 3. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/contract/types.go:129:22
   • 4. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/test/envtest/environment.go:89:47
   • 5. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller_status.go:189:26
   • 6. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller_status.go:123:26
   • 7. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1204:28
   • 8. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:690:26
   • 9. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:678:27
   • 10. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:253:33
   • 11. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:238:35
   • 12. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/mdutil/util.go:726:14
   • 13. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/mdutil/util.go:655:58
   • 14. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/machinedeployment_sync.go:623:15
   • 15. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/machinedeployment_rollout_ondelete.go:122:29
   • ... (truncated), run gosec locally to capture all failure for the rule G115
2. G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/util/util.go:61:8
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/util/conversion/conversion.go:160:18
3. G402: TLS InsecureSkipVerify set to true., Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/controlplane/kubeadm/internal/workload_cluster.go:481:62

Please review these findings and fix the issues before merging.

[bulwark-spectrocloud]

⚠️ GoSec scan found code issues:

1. G115: integer overflow conversion int64 -> int32, Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/cluster/cluster_controller_status.go:107:63
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/cluster/cluster_controller_status.go:104:70
   • 3. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/contract/types.go:129:22
   • 4. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/test/envtest/environment.go:89:47
   • 5. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller_status.go:189:26
   • 6. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller_status.go:123:26
   • 7. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1204:28
   • 8. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:690:26
   • 9. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:678:27
   • 10. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:253:33
   • 11. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:238:35
   • 12. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/mdutil/util.go:726:14
   • 13. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/mdutil/util.go:655:58
   • 14. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/machinedeployment_sync.go:623:15
   • 15. File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/machinedeployment_rollout_ondelete.go:122:29
   • ... (truncated), run gosec locally to capture all failure for the rule G115
2. G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/util/util.go:61:8
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/util/conversion/conversion.go:160:18
3. G402: TLS InsecureSkipVerify set to true., Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/controlplane/kubeadm/internal/workload_cluster.go:478:62

Please review these findings and fix the issues before merging.