[release-1.25] Bump K3s version

[brandond]

Proposed Changes

Bump K3s version for v1.25

Types of Changes

• version bump
• new feature
• bugfix

Verification

See linked issues

Linked Issues

• [release-1.25] New features from K3s: user-provided CA certs and kubeadm bootstrap token support #3894
• [Backport release-1.25] etcd.rke2.cattle.io/remove annotation cannot be used with etcd-only nodes  #3843

User-Facing Change

Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes
RKE2 now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before RKE2 starts in the K3s repo at [contrib/util/certs.sh](https://github.com/k3s-io/k3s/blob/master/contrib/util/certs.sh).
RKE2 now supports `kubeadm` style join tokens. `rke2 token create` now creates join token secrets, optionally with a limited TTL.
RKE2 agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster.
ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members. (ServiceLB is still disabled by default)