kubernetes: add support for setting job service accounts

[d4l3k]

Description

Currently our Kubernetes scheduler doesn't have a way to specify a jobs service account. This means that the job only can use the permissions provided by the node IAM role. For multi-user clusters you want more fine-grained security controls so we should add a way to set the service account via a runopt.

Detailed Proposal

Add a serviceaccount runopt to the scheduler:

torchx run -s kubernetes -c serviceaccount=myteam ...

or via .torchxconfig

[kubernetes]
serviceaccount=myteam

and it should add the service account to the spec

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

Additional context/links

https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/