What this PR does / why we need it:
This PR enables users with the Project viewer role to target the Shoot cluster by fetching the cluster CA via the <shoot-name>.ca-cluster ConfigMap.

To build the gardenlogin kubeconfig when targeting a Shoot cluster, gardenctl needs to read the cluster CA. In earlier versions, this was obtained from a .ca-cluster Secret. However, starting from Gardener v1.89, the cluster CA is also reconciled as a ConfigMap. This update allows users with the viewer role to read the ConfigMap, thereby facilitating the generation of the gardenlogin kubeconfig.

Side note:
gardenlogin v0.5 or higher is designed to fetch credentials from two subresources: shoots/adminkubeconfig and shoots/viewerkubeconfig. By default, it retrieves credentials from the shoots/adminkubeconfig subresource, providing full administrative access. Alternatively, it can fetch credentials from the shoots/viewerkubeconfig subresource for read-only access.

The plugin automatically adjusts the level of access for the fetched credentials. It first attempts to fetch admin-level credentials and, if unsuccessful, falls back to viewer-level credentials. This feature makes the gardenlogin kubeconfig versatile, as it can be used by both project admins and viewers without the need to specify the access level.

Which issue(s) this PR fixes:
Fixes #381

Special notes for your reviewer:
ref gardener/gardener#9091

Release note:

Users with the `Project` `viewer` role can now `target` shoot clusters and obtain the `kubeconfig` for these clusters. `gardenctl-v2` fetches the cluster CA via `ConfigMap` to generate the `gardenlogin` kubeconfig. This feature is supported with Gardener `v1.89` and requires `gardenlogin` `v0.5` or higher.