It wasn't clear to me that the `in_cluster` option for a
`kubernetes_sd_config` only affected authentication for service
discovery, and that to actually scrape the targets, it was still
necessary to explicitly set authentication options like `tls_config` and
`bearer_token_file`, for example, when scraping the Kubernetes
apiserver.

This patch clarifies that in the documentation for `in_cluster`, and
adds a link to the example Prometheus configuration for Kubernetes in
the Prometheus repo that explained this distinction better, and also
provides a useful real-world example of how to monitor a Kubernetes
cluster with Prometheus.