Proposal: kubeConfig contract for mandating PoP access tokens

[manojampalam]

Would like to propose the following contract in kubeConfig for a cluster that mandates access tokens with proof of posession (PoP) semantics.

kind: Config
preferences: {}
users:
- name: user-name
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      command: kubelogin
      args:
      - get-token
      - ...... specific auth flow parameters
      - --with-pop
      provideClusterInfo: true

--with-pop

To indicate that the returned token should be of type "pop" conforming to SHR format with API server's host name (conveyed via provideClusterInfo) captured as "u" claim.