[Feature] Allow wildcard matching of service account subject

[avoidik]

What feature/behavior/change do you want?

I would like to contribute a feature which will allow users to provide partial subjects in IAM role condition.

Why do you want this feature?

In some cases the IAM role can be shared between multiple service accounts (e.g. crossplane).

[avoidik]

PR https://github.com/eksctl-io/eksctl/pull/8629