Refresh vcluster pod service account tokens

[FabianKramm]

Right now we create a service account tokens that are valid for 10 years. Kubernetes was doing this similar up until 1.21 and then introduced expiring service account tokens. We should comply with this change and let our tokens expire similarly.

[mlbiam]

+1 that a vcluster's SA tokens expire after 10 years opens up not only the vcluster, but also any services a vcluster relies upon - such as an external Vault instance, to an attack based on a lost token. The only mitigation is making sure that external services submit a TokenAccessReview to the API server to validate that a Pod is still running, but if a Pod is long lived this only offers limited protection.