Consider hiding kubelet endpoints behind WG mesh

[fionera]

This is actually four things:

• [ ] Extending the WG Mesh to non-nodes
• [ ] Implementing WG Client in metroctl
• [ ] Adding WG proxy for kubectl into metroctl
• [ ] Disabling the public listening of kube-apiserver

[leoluk]

I suppose the issue might be better stated as "reduce kubelet endpoint attack surface", since there are other ways to potentially solve this.