Get a kubeconfig

A kubeconfig for this cluster with a freshly minted cluster token embedded, the same kind of token createKubernetesClusterToken returns. It holds no client certificate, and it stops working when the token expires after one hour. orl kube kubeconfig writes one that keeps working: it holds no token and runs orl kube token for each kubectl request. A cluster that is deleting or failed answers 409 INVALID_CLUSTER_STATE, and so does a cluster that is creating until its control plane's certificate authority exists. A restricted or pending organization can still get one. Needs clusters:write on an API key, or the owner, admin or member role on a session.