mgr/rook: don't leak a watcher thread per orchestrator call

KubernetesResource spawns a watch thread on the first access to
.items, and the thread runs until the watch stream ends. get_osds(),
get_resource() and the device fetchers create a KubernetesResource
per call, so one describe_service() leaks up to five threads, their
HTTPS connections to the apiserver, and the item dicts the threads
keep updating. Poll the orchestrator every few seconds and the active
mgr accumulates threads until it is OOM-killed.

Filter the long-lived rook_pods watch in get_osds() the way
describe_pods() does. Convert the other per-call sites to
fetch_k8s_items(), a one-shot list call that spawns no watcher.
KubernetesResource stays watch-only, for the three long-lived caches
in RookCluster.

Fixes: https://tracker.ceph.com/issues/78589
Signed-off-by: Kefu Chai <k.chai@proxmox.com>