text: Title: reduce configmap and secret watch of kubelet
  Body: <!--  Thanks for sending a pull request!  Here are some tips for you:
  
  1. If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide/first-contribution.md#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
  2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
  https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
  3. Ensure you have added or ran the appropriate tests for your PR: https://git.k8s.io/community/contributors/devel/sig-testing/testing.md
  4. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
  5. If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
  -->
  
  #### What type of PR is this?
  /kind feature
  
  #### What this PR does / why we need it:
  In a large cluster, if a large number of pods reference configmap/secret as environment variables, kubelet will generate a lot of watches for configmap and secret, and kube-apiserver will use too much memory due to too many watches.
  Although we have added Immutable features, in real usage scenarios, many configmaps are not marked as Immutable.
  
  #### Which issue(s) this PR fixes:
  Fixes #98660 
  
  #### Special notes for your reviewer:
  @wojtek-t 
  
  #### Does this PR introduce a user-facing change?
  <!--
  If no, just write "NONE" in the release-note block below.
  If yes, a release note is required:
  Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
  
  For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
  -->
  ```release-note
  When the kubelet is watching a ConfigMap or Secret purely in the context of setting environment variables
  for containers, only hold that watch for a defined duration before cancelling it. This change reduces the CPU
  and memory usage of the kube-apiserver in large clusters.
  ```
  
  #### Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:
  
  <!--
  This section can be blank if this pull request does not require a release note.
  
  When adding links which point to resources within git repositories, like
  KEPs or supporting documentation, please reference a specific commit and avoid
  linking directly to the master branch. This ensures that links reference a
  specific point in time, rather than a document that may change over time.
  
  See here for guidance on getting permanent links to files: https://help.github.com/en/articles/getting-permanent-links-to-files
  
  Please use the following format for linking documentation:
  - [KEP]: <link>
  - [Usage]: <link>
  - [Other doc]: <link>
  -->
  ```docs
  
  ```
  