Legacy cert signing path uses same key for kubelet and kube-proxy

[brandond]

Environmental Info:
K3s Version: v1.32.2

Node(s) CPU architecture, OS, and Version: n/a

Cluster Configuration: n/a

Describe the bug:
Legacy client certificate generation uses the wrong key to sign the kubelet cert. The kube-proxy key is used and sent, instead of the kubelet key.

This isn't a huge deal because

1. only legacy (down-level) clients still use this code path
2. clients already have this key so it's not sharing anything they don't already have

Steps To Reproduce:
Connect a pre #11471 client to a newer server

Expected behavior:
Different keys are used

Actual behavior:
The kubelet and kube-proxy certs use the same private key

Additional context / logs:
From @AaronDewes in #12011

[aganesh-suse]

Closing base on: #12215