KEP-4872: Harden Kubelet serving cert validation

[g-gaston]

- One-line PR description: Add first version of doc

• Issue link: https://github.com/kubernetes/enhancements/issues/4872

• Other comments: I left a few TODOs with things I think can use a discussion.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: g-gaston Once this PR has been reviewed and has the lgtm label, please assign ritazh for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[keps/sig-auth/OWNERS](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

[aojea]

+1 sounds a great addition, simple and very effective