fix(node-servant): add system:nodes group to yurt-hub-multiplexer ClusterRoleBinding

[Pragnasri-363]

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fixes node-servant conversion failing with "context deadline exceeded" during label-driven edge node conversion. Root cause: YurtHub authenticates as system:node:<name>, but the yurt-hub-multiplexer ClusterRole is bound only to the openyurt:multiplexer group. Since node identities are never added to this group, YurtHub is being denied access to ConfigMaps and NodePool resources it needs at startup, causing it to never reach a ready state, node-servant then times out waiting for YurtHub's readiness signal.

This PR adds the system:nodes group (which all node identities automatically belong to) to the yurt-hub-multiplexer-binding ClusterRoleBinding as part of the conversion process. This is done once, idempotently, covering all current and future nodes — rather than adding individual per-node entries, which would grow unboundedly at scale.

Which issue(s) this PR fixes:

Fixes #2716

Special notes for your reviewer:

This adds a system:nodes Group subject rather than per-node User entries, to avoid the ClusterRoleBinding's subject list growing unboundedly as nodes are converted. Uses retry.RetryOnConflict to handle concurrent conversions safely.

Does this PR introduce a user-facing change?

Fixed node-servant conversion failing with "context deadline exceeded" due to missing RBAC permissions for YurtHub during edge node conversion.

other Note

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Pragnasri-363]

Following up on my own PR: I tested this fix directly against a live cluster (manually applying the ClusterRoleBinding change) and confirmed it does not actually resolve the issue ,check my updated comment on #2716 for the full explanation.

Root cause is deeper than RBAC: Kubernetes' NodeRestriction admission controller blocks list/watch for node identities on ConfigMaps regardless of ClusterRoleBinding contents.I'll look into whether YurtHub can use a different identity for these specific calls, or update this PR with a different approach.Would like to take your advice @luckymrwang before proceeding further on this.