kubernetes: VisitContainers called from *InUse methods is not safe

What happened:

In 1.16, #59416 modified the VisitContainers() helper method to conditionally iterate over the EphemeralContainers field, based on whether the EphemeralContainers feature gate was enabled.

This method is called in pkg/api/pod/util.go to:

1. determine if any containers are using a particular alpha field
2. clear a particular alpha field in all containers

On update, if the existing pod has ephemeral containers, the new pod is permitted to specify those ephemeral containers as well, even if the feature is currently disabled (this avoids data loss on API object update).

That means that when the ephemeral feature is not enabled:

1. an existing pod that is using a particular feature in an ephemeral container may not be detected correctly
2. alpha fields might not be cleared correctly in the ephemeral containers in the pod
3. node authorizer will not recognize secrets/configmaps in envFrom in ephemeral containers in existing pods, so kubelets will not be authorized to fetch those secrets/configmaps

The caller needs to indicate whether they want to iterate over all containers or just ones that are feature-enabled

/cc @verb