What would you like to be added:

• when finding IAM Role using for assume role also support eks.amazonaws.com/role-arn annotation instead of eks.amazonaws.com/ecr-role-arn
• If option not provided both eks.amazonaws.com/ecr-role-arn and environment variable of AWS_ECR_ROLE_ARN , provider will try to find a role by eks.amazonaws.com/role-arn annotation

Why is this needed:

• in the default, Pod identity webhook injects project token to annotated eks.amazonaws.com/role-arn ref: https://github.com/aws/amazon-eks-pod-identity-webhook/blob/master/pkg/annotations.go#L21
• If user wants to project token for only pull image, still must specify both of eks.amazonaws.com/role-arn and eks.amazonaws.com/ecr-role-arn

/kind feature