Workload cluster release azure-35.1.0 for CAPZ

Changes compared to v35.0.1

Add initial Bring-Your-Own-Network support.
Add option to be able to disable the Private Link on private clusters (.global.connectivity.network.enablePrivateLinkWithPrivateMode). Useful for BYON scenarios.

Add preKubeadmCommandsTemplateName and postKubeadmCommandsTemplateName hooks under providerIntegration.controlPlane.kubeadmConfig and providerIntegration.workers.kubeadmConfig. They name a provider template that renders a YAML list of additional kubeadm commands, once for the control plane and once per node pool for workers.
Add internal.advancedConfiguration.kubelet.evictionHard values. Providers need them to tell autoscalers such as Karpenter how much of a node’s resources is allocatable.
SELinux: Add global.components.selinux.writablePolicyStore value (default true) to allow loading additional SELinux policies.

Enable the ClusterTrustBundle and ClusterTrustBundleProjection feature gates (Kubernetes 1.33+) and the PodCertificateRequest feature gate (Kubernetes 1.35+) by default on kube-apiserver, kube-controller-manager and kubelet.
SELinux: Keep AVC audit logs (required for SELinux policy generation).
SELinux: Relabel the whole filesystem except read-only /usr (previously only /etc/kubernetes).
SELinux: Correctly label CA certificates in /etc/ssl/certs for mounting into containers.
App to HR Migration: Skip v35.0.0 pre-releases and update docker-kubectl to v1.36.4.
Chart: Rework HelmRelease clean-up job.