ipn/store/kubestore,kube: fix cert error in admin UI (#16717)

Also adds a test to kube/kubeclient to defend against the error type
returned by the client changing in future.

Fixes tailscale/corp#30855

Change-Id: Id11d4295003e66ad5c29a687f1239333c21226a4

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>

ipn/store/kubestore/store_kube_test.go

@@ -426,6 +426,13 @@ func TestReadTLSCertAndKey(t *testing.T) {
 			secretGetErr:  &kubeapi.Status{Code: 404},
 			wantErr:       ipn.ErrStateNotExist,
 		},
+		{
+			name:          "cert_share_ro_mode_forbidden",
+			certShareMode: "ro",
+			domain:        testDomain,
+			secretGetErr:  &kubeapi.Status{Code: 403},
+			wantErr:       ipn.ErrStateNotExist,
+		},
 		{
 			name:          "cert_share_ro_mode_empty_cert_in_secret",
 			certShareMode: "ro",