azure: download nodeup from Blob Storage with curl - #18666

When KOPS_BASE_URL is an azureblob://<account>/<container>/<key> URL on
an Azure cluster, the bootstrap script downloads nodeup with curl. It
requests an OAuth token for the system-assigned managed identity from
the instance metadata service and passes the Authorization and
x-ms-version headers to curl through stdin, so the token never reaches
disk, process arguments, or console logs. The GCS branch now parses its
service account token with the same json-field helper.

The download URL hard-codes the public blob.core.windows.net endpoint,
so validation rejects non-public AZURE_ENVIRONMENT values. Source
locations are percent-escaped and validated when the script is
rendered, so malformed URLs fail during kops update rather than in the
boot retry loop.

spec.assets.fileRepository now accepts an azureblob:// URL on Azure, so
that the node assets can be hosted in the same private container. The
URL must include a container, and nodes on other clouds cannot
authenticate to Azure Blob Storage, so validation keeps rejecting it
there. Nodeup reads these assets through VFS using the managed identity
credentials, and "kops get assets --copy" can now also write to an
azureblob:// repository.

Access is not granted automatically: the docs describe granting Storage
Blob Data Reader on the assets container only, never on the state-store
account, which would let nodes read the cluster PKI.