Documentation about "containerMode: kubernetes"

Hi,

The page "docs/deploying-alternative-runners.md" discusses the feature "containerMode: kubernetes". It could be helpful to add content to that document.

This issue is a "feature request" to "add documentation" if you think it's reasonable.

1. It mentions "serviceAccountName: my-service-account". As a reader, I wonder if that is a service account that is expected to already exist, with all necessary permissions in place, or if that is a service account ARC will be generating on my behalf, and so nothing more is required. Explain the answer to that. Such as saying "you must create the service account my-service-account before proceeding."

2. If it's an account that I am required to create ahead of time, along with RBAC, role and rolebinding, then it would be a good idea to show example manifests, rather than leaving that part as an exercise for the reader. Here's an example that seemed to work, and could be added onto that page.

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: runner-service-account
  namespace: actions-runner-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: actions-runner-system
  name: runner-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "create", "delete"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["get", "create"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get", "list", "watch",]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get", "list", "create", "delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: runner-role-binding
  namespace: actions-runner-system
subjects:
- kind: ServiceAccount
  name: runner-service-account
  apiGroup: ""
roleRef:
  kind: Role
  name: runner-role
  apiGroup: rbac.authorization.k8s.io

Update docs/deploying-alternative-runners.md, starting at the containerMode: kubernetes section and its serviceAccountName example. Clarify whether the service account must already exist, and document the required setup with the ServiceAccount, Role, and RoleBinding manifests from the issue. Done means readers can understand the prerequisite and follow a complete example.