Go 1.25 added a new `containermaxprocs` setting that controls whether the Go
runtime will consider cgroup CPU limits when setting the default GOMAXPROCS.
The default value `containermaxprocs=1` will use cgroup limits in addition to
the total logical CPU count and CPU affinity. `containermaxprocs=0` will
disable consideration of cgroup limits. This setting only affects Linux.

  vendor: Updated `k8s.io/system-validators` to `v1.12.1`. The cgroups validator now throws an error instead of a warning if cgroups v1 is detected on the host and the provided KubeletVersion is `v1.35` or newer.
  

- Fixed a bug where the kubelet ephemerally failed with `failed to initialize top level QOS containers: root container [kubepods] doesn't exist`, due to the cpuset cgroup being deleted on cgroup v2 with systemd cgroup manager.
   ([#125923](https://github.com/kubernetes/kubernetes/pull/125923), [@haircommander](https://github.com/haircommander)) [SIG Node and Testing]

- Kube-controller-manager: alpha gauge metrics for informer queue length are now published as `informer_queued_items{name=kube-controller-manager,group=<group>,resource=<resource>,version=<version>} <count>` ([#135782](https://g...

  For metrics `etcd_request_duration_seconds`, `etcd_requests_total` and `etcd_request_errors_total` replace `type` label with API `resource` and `group` label.
  For metric `apiserver_selfrequest_total` add a API `group` label.

### Bug or Regression

- Bump system-validators to v1.9.2: remove version-specific cgroup kernel config checks to avoid false failures on cgroup v2 systems when v1-only configs are missing. ([#134086](https://github.com/kubernetes/kubernetes/pull/134086), [@pacoxu](https://github.com/pacoxu)) [SIG Cluster Lifecycle]

        assertEquals("2group$special", permissionHelper.encode("{group}group$special"));
    }

    @Test
    public void test_decode_withComplexValues() {
        assertEquals("{user}******@****.***", permissionHelper.decode("******@****.***"));
        assertEquals("{group}group/subgroup", permissionHelper.decode("2group/subgroup"));

        for (int i = 0; i < 5; i++) {
            List<String> groups = new ArrayList<>();
            groups.add("group_" + i);
            List<String> roles = new ArrayList<>();
            List<String> groupIds = new ArrayList<>();
            groupIds.add("id_" + i);

            try {
                method.invoke(authenticator, null, groups, roles, groupIds);
            } catch (Exception e) {

        form.groups = new String[] { "group1", "group2" };

        assertNotNull(form.roles);
        assertEquals(2, form.roles.length);
        assertEquals("admin", form.roles[0]);
        assertEquals("user", form.roles[1]);

        assertNotNull(form.groups);
        assertEquals(2, form.groups.length);
        assertEquals("group1", form.groups[0]);
        assertEquals("group2", form.groups[1]);

        assertNotNull(groupNames);
        assertEquals(2, groupNames.length);
        assertEquals("group1", groupNames[0]);
        assertEquals("group2", groupNames[1]);
    }

    @Test
    public void test_getGroupNames_empty() {
        // Test when no groups match the prefix
        ComponentUtil.setFessConfig(new FessConfig.SimpleImpl() {
            @Override