Default kubelet authorization-mode to Webhook for k8s 1.19+

[johngmyers]

Kubelet defaults the authorization mode to Webhook when the --config flag is provided, but it defaults to the insecure AlwaysAllow mode when the --config flag is not provided.

Since kops uses (the deprecated) flags instead of a config file, this change causes us to get the more secure default.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johngmyers

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [johngmyers]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hakman]

Would be best if you add a short description?
Seems similar to #7200.

[johngmyers]

It might make sense to change the default of AuthenticationTokenWebhook at the same time, but kubelet does not change its default based on whether or not there is a config file.

[johngmyers]

On second thought, AuthenticationTokenWebhook is orthogonal. Instead of disabling insecure features it is enabling additional functionality. A change to its default should be a separate PR.

[hakman]

Cool. Got it now.
/lgtm