Enabling serviceaccounts watch list permission

### Pre-requisites

- [X] I have double-checked my configuration
- [X] I can confirm the issues exists when I tested with `:latest`
- [X] I'd like to contribute the fix myself (see [contributing guide](https://github.com/argoproj/argo-workflows/blob/master/docs/CONTRIBUTING.md))

### What happened/what you expected to happen?

E1121 09:46:13.616793 1 reflector.go:138] pkg/mod/k8s.io/client-go@v0.24.3/tools/cache/reflector.go:167: Failed to watch *v1.ServiceAccount: failed to list *v1.ServiceAccount: serviceaccounts is forbidden: User "system:serviceaccount:argocd:argo-workflow-argo-workflows-server" cannot list resource "serviceaccounts" in API group "" at the cluster scope
W1121 09:46:23.449686 1 reflector.go:324] pkg/mod/k8s.io/client-go@v0.24.3/tools/cache/reflector.go:167: failed to list *v1.ServiceAccount: serviceaccounts is forbidden: User "system:serviceaccount:argocd:argo-workflow-argo-workflows-server" cannot list resource "serviceaccounts" in API group "" at the cluster scope

### Version

"0.20.8"

### Paste a small workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflows that uses private images.

```YAML
When you enable sso you need to add this permission manually in cluster roles.
```

### Logs from the workflow controller

kubectl logs -n argo deploy/workflow-controller | grep ${workflow}

E1121 09:46:13.616793 1 reflector.go:138] pkg/mod/k8s.io/client-go@v0.24.3/tools/cache/reflector.go:167: Failed to watch *v1.ServiceAccount: failed to list *v1.ServiceAccount: serviceaccounts is forbidden: User "system:serviceaccount:argocd:argo-workflow-argo-workflows-server" cannot list resource "serviceaccounts" in API group "" at the cluster scope
W1121 09:46:23.449686 1 reflector.go:324] pkg/mod/k8s.io/client-go@v0.24.3/tools/cache/reflector.go:167: failed to list *v1.ServiceAccount: serviceaccounts is forbidden: User "system:serviceaccount:argocd:argo-workflow-argo-workflows-server" cannot list resource "serviceaccounts" in API group "" at the cluster scope

### Logs from in your workflow's wait container

kubectl logs -n argo -c wait -l workflows.argoproj.io/workflow=${workflow},workflow.argoproj.io/phase!=Succeeded

Start with the SSO configuration and Kubernetes cluster roles mentioned in the report, then reproduce the failure on version 0.20.8 or :latest while watching the argo-workflows-server logs. Trace the denied ServiceAccount list/watch request and verify that the server no longer reports forbidden errors when SSO is enabled.

Written by the indexing model from the issue text.