Extract custom cloud certificate handling from init-aks-cloud

[Devinwong]

Summary

Extract custom-cloud certificate bootstrap and refresh handling from init-aks-cloud.sh into init-aks-custom-cloud-certs.sh so it can be owned and tested independently.

Reviewer note: This PR looks much larger than the functional change because most of the diff is existing certificate functions and top-level logic moving from init-aks-cloud.sh into the new file. The meaningful changes are the delegation call, refresh schedule target, delivery wiring, and focused tests.

• deliver the extracted script through CustomData, Packer, ImageCustomizer, and ANC hotfixes
• keep init-aks-cloud.sh as the entrypoint and delegate certificate handling to its sibling script
• update cron/systemd refresh jobs to invoke the extracted script
• add ShellSpec coverage for endpoint selection, including LOCATION=usseceast selecting legacy mode

Context

• ADO 38892447
• PR #8886 review follow-up

Validation

• make generate
• focused ShellSpec: 21 examples, 0 failures
• package tests and shell validation run as part of generation

[github-actions]

PR Title Lint Failed ❌

Current Title: Extract custom cloud certificate handling from init-aks-cloud

Your PR title doesn't follow the expected format. Please update your PR title to follow one of these patterns:

Conventional Commits Format:

• feat: add new feature - for new features
• fix: resolve bug in component - for bug fixes
• docs: update README - for documentation changes
• refactor: improve code structure - for refactoring
• test: add unit tests - for test additions
• chore: remove dead code - for maintenance tasks
• chore(deps): update dependencies - for updating dependencies
• ci: update build pipeline - for CI/CD changes

Guidelines:

• Use lowercase for the type and description
• Keep the description concise but descriptive
• Use imperative mood (e.g., "add" not "adds" or "added")
• Don't end with a period

Examples:

• ✅ feat(windows): add secure TLS bootstrapping for Windows nodes
• ✅ fix: resolve kubelet certificate rotation issue
• ✅ docs: update installation guide
• ❌ Added new feature
• ❌ Fix bug.
• ❌ Update docs

Please update your PR title and the lint check will run again automatically.

[github-actions]

Windows Unit Test Results

  3 files   11 suites   51s ⏱️
381 tests 381 ✅ 0 💤 0 ❌
384 runs  384 ✅ 0 💤 0 ❌

Results for commit 3b49a1d.