Improve Token Model implementation.

[bsctl]

In Talos, Token Model generation requires to run this ONCE per cluster:

$ talosctl gen secrets -o secrets.yaml

This generates ONE token for the entire cluster, example: 32gegb.6te1tl2s8wfy5g16

Token Distribution:

                  talosctl gen secrets
                         ↓
                    secrets.yaml
                         ↓
        ┌────────────────┴────────────────┐
        ↓                                 ↓
     CSR Signer                       ALL Workers
   token: 32gegb...                  token: 32gegb... (SAME)

Both Talos and CSR Signer implements same model:

• One token per cluster
• All workers share the same token
• Token in both controlplane.yaml AND worker.yaml (same value)
• CSR Signer validates this exact token (stored in K8s secret)
• Talos trustd validates this exact token (stored in Talos state)

A possible improvement of the CSR Signer is to expose an API to generate the token instead to leverage on talosctl. This would be a similar to kubeadm does for kubernetes join token:

# Create k8s join token
$ kubeadm --kubeconfig $TENANT.kubeconfig token create
abcdef.0123456789abcdef

# List k8s join tokens
$ kubeadm --kubeconfig $TENANT.kubeconfig token create
TOKEN                     TTL         EXPIRES
abcdef.0123456789abcdef   23h         2024-10-30T12:00:00Z

# Delete k8s join token
$ kubeadm --kubeconfig $TENANT.kubeconfig token delete abcdef.0123456789abcdef