feat: add ImagePullIdentityProfile for identity binding-based image pull

[qweeah]

What type of PR is this?
/kind feature

This PR adds support for identity binding-based image pull authentication from Azure Container Registry (ACR), implementing KEP-4412 projected service account tokens for kubelet image credential providers.

To support identity binding-based image pull feature changes in AgentBaker, we plan to implement it in three parts:

• Part 1 (this PR): Adds data model and test baseline
• Part 2: RP integration and configuration flow
• Part 3: CSE implementation and credential provider configuration

What this PR does / why we need it:

Data Model Changes

• Added ImagePullIdentityProfile struct to SecurityProfile containing:
  • Enabled: Boolean flag to enable/disable the feature
  • DefaultClientID: Cluster-wide default managed identity client ID
  • DefaultTenantID: Cluster-wide default managed identity tenant ID
  • LocalAuthoritySNI: SNI endpoint for Identity Bindings Local Authority

Helper Functions

• Added GetImagePullIdentity() method to retrieve image pull identity configuration
• Added IsImagePullIdentityBindingEnabled() method to check if feature is enabled
• Added helper functions in variables.go:
  • getImagePullIdentityDefaultClientID()
  • getImagePullIdentityDefaultTenantID()
  • getImagePullIdentityLocalAuthoritySNI()

Variable Mappings

• Added template variables for CSE script consumption:
  • imagePullIdentityBindingEnabled
  • imagePullIdentityDefaultClientID
  • imagePullIdentityDefaultTenantID
  • identityBindingsLocalAuthoritySNI

Which issue(s) this PR fixes:

Fixes #

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• tested upgrade from previous version
• commits are GPG signed and Github marks them as verified

Special notes for your reviewer:

Release note:

none