Multi-tenant OIDC authentication

[matheuscscp]

As a Flux user, I'd like to have multi-tenant OIDC authentication for my cloud provider, so that I can have fine-grained identities with permissions limited to what each tenant needs.

Right now Flux uses the ServiceAccount of the respective controller for OIDC authentication.

For example, I'd like my Bucket objects with spec.provider set to some cloud provider to also have something like a spec.serviceAccountName field pointing to a Kubernetes ServiceAccount in the same namespace that points to an identity in my cloud provider, and Flux would perform the authentication handshake for that identity using a temporary OIDC ServiceAccount token created on the Kubernetes API.