feat: remove M2M agent impersonation RBAC, keep OBO

[QuentinBisson]

Removes the M2M agent-impersonation feature from agentic-platform-connectivity, part of the cross-repo M2M removal (mcp-oauth v0.18.7, muster #936, mcp-kubernetes #530). On-behalf-of (OBO) is the only supported agent->downstream flow.

What changed

• Deleted the agents.<name>.m2m values block (both the umbrella agentic-platform and agentic-platform-connectivity) and the kagent/agents/impersonation.yaml + _agent-impersonation.tpl templates it rendered.
• An agent no longer gets a deputy Role/ClusterRole letting mcp-kubernetes impersonate the agent's own SA identity, nor a ClusterRoleBinding binding the agent's groups to cluster authz (e.g. read-all).
• OBO is unaffected: muster mints a token with the human as sub and the agent SA in the RFC 8693 act claim, and the mcp-kubernetes chart's *-obo-impersonate ClusterRole (not this chart) authorizes impersonating the human. The human's downstream RBAC governs access.
• Reworded the M2M section of docs/authentication.md to the OBO model and pruned M2M terminology from the agent values comments.

Verification

helm lint passes (0 chart failures); rendering with m2m.enabled=true now produces zero impersonation objects (the value is inert). Coordinated with giantswarm-configs cleanup to drop the matching muster workloadGroupGrants/actorDelegationPolicy and mcp-kubernetes impersonateUser/alias/allowedActors keys.