What type of PR is this?

/kind bug
/kind cleanup
/kind failing-test

What this PR does / why we need it:

Fix to #122893; The previous fix changed the behavior of EnsureAdminClusterRoleBindingImpl under the assumption that the unit test was correct and the real-world behavior was wrong, but in fact, the real-world behavior was already correct, and the unit test was expecting the wrong result because of the difference in behavior between real and fake clients.

Comparing the original state, the post-122893 state, and the new state with this commit:

• If the Create() succeeds:
  • original: crbResult would contain the result of the Create (line 640), and so crbResult != nil would be true and we'd return adminClient, nil (line 672-673)
  • 122893: same
  • new: crbExists would be set to true (line 661), so crbExists would be true and we'd return adminClient, nil (line 669-670)
• If the Create() fails with apierrors.IsForbidden()
  • original: crbResult would get set to nil (line 653), so crbResult != nil would be false (line 672) and we'd try the superAdminClient
  • 122893: same except crbClient gets set to nil on line 648
  • new: crbExists never gets set to true, so crbExists would be false on line 669 and we'd try the superAdminClient
• If the Create() fails with apierrors.IsAlreadyExists()
  • original:
    • in CI, crbResult is nil, so the crbResult != nil check at line 672 fails so we fall through to maybe try with the superAdminClient, which will fail whether or not superAdminClient is set; This is not the correct behavior, but the "admin.conf: CRB already exists, use the admin.conf client" test had expectedError: true anyway! 🙁
    • in the real world, crbResult is an empty CRB object, so the crbResult != nil check at line 672 succeeds and we return the adminClient, which is what was supposed to happen
  • 122893: both in CI and in the real world, crbResult gets set to nil (line 648), so we fall through at line 671 rather than returning the adminClient. This caused kubeadm-kinder-upgrade-*-1-29-latest failed for existing ClusterRoleBinding kubeadm#3000
  • new: both in CI and in the real world, crbExists gets set to true (line 653), so the check at line 669 succeeds and we return the adminClient, fixing the bug
• If the Create() fails with any other error and eventually times out:
  • original: crbResult is nil in CI and non-nil in the real world, but it doesn't matter because, we see that err != nil and return lastError (line 667-668)
  • 122893: crbResult is nil either way, but again, we return lastError before checking it
  • new: crbExists is fasl either way, but again, we return lastError before checking it

So I think this should be correct...

Which issue(s) this PR fixes:

Fixes kubernetes/kubeadm#3000

Does this PR introduce a user-facing change?

NONE

/assign @neolit123 @pacoxu