Move certs job service account token (#3951)

[sjberman]

Cherrypick of #3951

Problem: For security reasons, it's best practice to not have automountServiceToken on the ServiceAccount, and instead set in directly on the workloads that need the token.

Solution: Set this field on the Pods instead of the ServiceAccounts.

This was missed as part of the original PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.91%. Comparing base (4b7ff0e) to head (d74c5c9).
⚠️ Report is 1 commits behind head on release-2.1.

Additional details and impacted files

@@               Coverage Diff               @@
##           release-2.1    #3952      +/-   ##
===============================================
+ Coverage        86.88%   86.91%   +0.03%     
===============================================
  Files              128      128              
  Lines            16013    16013              
  Branches            62       62              
===============================================
+ Hits             13913    13918       +5     
+ Misses            1930     1926       -4     
+ Partials           170      169       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.