Fix multiple profile handling for kube credentials (#23705) (#23718)

This PR fixes the multi profile handling for Kubernetes Access flow.
Previously, `tsh kube credentials` assumed the default profile because
no proxy was provided when kubectl invokes the credentials plugin which
resulted in usage of wrong certificates.

This PR prevents that by appending the `--proxy` flag to kubectl exec
plugin which allows `tsh kube credentials` to correctly identify the
correct profile.

tool/tsh/kube.go

@@ -1148,6 +1148,10 @@ func updateKubeConfig(cf *CLIConf, tc *client.TeleportClient, path string) error
 		return trace.Wrap(err)
 	}
 
+	if cf.Proxy == "" {
+		cf.Proxy = tc.WebProxyAddr
+	}
+
 	values, err := buildKubeConfigUpdate(cf, kubeStatus)
 	if err != nil {
 		return trace.Wrap(err)