automountServiceAccountToken: false doesn't remove token from Job Container

Checks

• I've already read https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md and I'm sure my issue is not covered in the troubleshooting guide.
• I'm not using a custom entrypoint in my runner image

Controller Version

0.27.2

Helm Chart Version

0.23.1

CertManager Version

v1.11.1

Deployment Method

Helm

cert-manager installation

Yes

Checks

• This isn't a question or user support case (For Q&A and community support, go to Discussions. It might also be a good idea to contract with any of contributors and maintainers if your business is so critical and therefore you need priority support
• I've read releasenotes before submitting this issue and I'm sure it's not due to any recently-introduced backward-incompatible changes
• My actions-runner-controller version (v0.x.y) does support the feature
• I've already upgraded ARC (including the CRDs, see charts/actions-runner-controller/docs/UPGRADING.md for details) to the latest and it didn't fix the issue
• I've migrated to the workflow job webhook event (if you using webhook driven scaling)

Resource Definitions

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: runner-sa
  namespace: actions-runner-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: runner-role
  namespace: actions-runner-system
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "create", "delete"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["get", "create"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["get", "list", "create", "delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "create", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: runner-rolebinding
  namespace: actions-runner-system
subjects:
  - kind: ServiceAccount
    name: runner-sa
    namespace: actions-runner-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: runner-role
---
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: my-silverblue-runners
  namespace: actions-runner-system
spec:
  template:
    spec:
      repository: J0n4t4n/my-silverblue
      containerMode: kubernetes
      serviceAccountName: runner-sa
      automountServiceAccountToken: false
      workVolumeClaimTemplate:
        storageClassName: longhorn
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 5Gi
      containers:
        - name: runner
          volumeMounts:
            - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
              name: kube-api-access
              readOnly: true
      volumes:
        - name: kube-api-access
          projected:
            defaultMode: 420
            sources:
              - serviceAccountToken:
                  expirationSeconds: 3607
                  path: token
              - configMap:
                  items:
                    - key: ca.crt
                      path: ca.crt
                  name: kube-root-ca.crt
              - downwardAPI:
                  items:
                    - fieldRef:
                        apiVersion: v1
                        fieldPath: metadata.namespace
                      path: namespace

To Reproduce

1. Deploy RunnerDeployment with automountServiceAccountToken: false
2. Run a Workflow that spawns a Job Container
3. Check Pod Spec of spawned container
4. See that ServiceAccountToken is automatically mounted

Describe the bug

Disabling automountServiceAccountToken doesn't disable it for the Job Pods that are spawned by the runner.
This results in my building failing, as it has to delete the content of /var/*

Describe the expected behavior

I expect that disabling the automount also disables it from automatically mounting in the Job Containers.

Whole Controller Logs

https://gist.github.com/J0n4t4n/ce0d98ed45c7cb072811fcf34a23cf01

Whole Runner Pod Logs

https://gist.github.com/J0n4t4n/ce0d98ed45c7cb072811fcf34a23cf01

Additional Context

No response

No source files or tests are named. Start by reproducing the RunnerDeployment configuration and workflow described in the issue, then compare the spawned Job Pod Spec with automountServiceAccountToken set to false. Done means the spawned Job containers no longer receive the automatically mounted service-account token while the runner remains functional.