Allow setting a default service account for impersonation

[stefanprodan]

Introduce the flag --default-service-account for allowing cluster admins to enforce impersonation across the cluster without having to use an admission controller.

When the flag is set to a value that's not empty string, all HelmReleases which don't have spec.serviceAccountName specified will use the service account name provided by --default-service-account=<SA Name> in the namespace of the object.

Breaking changes:

• When --default-service-account=<SA name> and/or spec.ServiceAccountName are specified, the controller no longer queries the API to extract and use the SA token. Instead, the controller relies on the Kubernetes impersonation feature to run the reconciliation under the system:serviceaccount:<SA Namespace>:<SA Name> identity. This impacts only clusters with custom made tokens and automountServiceAccountToken disabled. If a service account token points to a different identity (which should never be the case), then the controller will fail to reconcile with Forbidden : User "system:serviceaccount:my-namespace:my-sa-name" cannot create resource.
• When both spec.kubeConfig and spec.ServiceAccountName are specified, the controller will impersonate the service account on the target cluster, previously the controller ignored the service account.

Part of: fluxcd/flux2#2340

[hiddeco]

Thanks for following through on requested changes 🙇