Remove duplicate last-used PATCH in legacy service account validator (1.37.0 rebase) #4520

What exists today

In the kcp-dev/kubernetes 1.37.0 rebase (kcp-dev/kubernetes#198), pkg/serviceaccount/legacy.go, legacyValidator.Validate contains an inline "last-used" label PATCH block (around lines 176-190). It duplicates patchSecretWithLastUsedDate, which is called right after it.

• When the last-used label is stale, each authentication with the token sends two PATCH requests until the first one lands in the informer cache.
• The inline block omits .WithUID(secret.UID), so it can label a secret that was deleted and recreated under the same name. The helper guards against that.
• This looks like a rebase merge artifact. Upstream v1.37.0 only calls the helper.

What should replace it

Remove the inline block and keep only the helper call:

v.patchSecretWithLastUsedDate(ctx, secret, private.ClusterName)

References

• PR: Update to 1.37.0 kubernetes#198
• Requesting comment: Update to 1.37.0 kubernetes#198 (comment)
• Original finding: Update to 1.37.0 kubernetes#198 (comment)

Steps

• Delete the inline last-used PATCH block in legacyValidator.Validate (pkg/serviceaccount/legacy.go)
• Keep the single patchSecretWithLastUsedDate(ctx, secret, private.ClusterName) call
• Check the kcp-dev/kubernetes-patches patch carrying this change for the same duplication
• Confirm the diff against upstream v1.37.0 pkg/serviceaccount/legacy.go shows only the kcp cluster-scoping changes