Remove outdated ciphers from API server flags

[AndiDog]

The cluster chart hardcodes a cipher list. Because of AWS ELB health checks not supporting newer ciphers (kubernetes-sigs/cluster-api-provider-aws#5139), we need to keep a few RSA-based ones. When comparing the latest secure ciphers preferred in Go 1.23 to our list ({{- define "cluster.internal.controlPlane.kubeadm.clusterConfiguration.apiServer.tlsCipherSuites" }}), there are however two ciphers that likely can go away:

• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

Both have newer *_SHA256 alternatives supported in Go.

[yulianedyalkova]

Let's also please only ship this feature with v30 releases.

[yulianedyalkova]

Currently blocked on #3778.