Global configuration for workflow service account annotations

[abangser]

In order to securely connect to cloud resources from a Kratix Workflow users may want to use cloud specific service accounts. In all three major clouds (AWS, GCP, Azure) they require the service account the pod uses to have an annotation.

We should enable a global configuration which allows Kratix admins to set annotations on the workflow created service accounts.

This is starting as a global configuration, but we expect to fast follow with a local override. In the meantime, if someone wants to have a specific workflow service account use a different annotation, they can manually set the service account.