Error raised when `storageClassName` is defined with `templateReferencing: Secure`

### Pre-requisites

- [X] I have double-checked my configuration
- [X] I can confirm the issues exists when I tested with `:latest`
- [ ] I'd like to contribute the fix myself (see [contributing guide](https://github.com/argoproj/argo-workflows/blob/main/docs/CONTRIBUTING.md))

### What happened/what did you expect to happen?

Hello.

I have a workflow-controller **templateReferencing** set to **Secure**.
When I create a ClusterWorkflowTemplate with storageClassName parameter settet in the volumeClaimTemplates im receiveing an error:
_"WorkflowSpec may not change during execution when the controller is set `templateReferencing: Secure`"_
Same ClusterWorkflowTemplate without **storageClassName** param works just fine.

### Version

v3.5.2

### Paste a small workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflows that uses private images.

```YAML
apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
name: volumes-pvc-storage-class-name
spec:
templates:

- name: volumes-pvc-example
steps:
- - name: step-1
template: step-1

- name: step-1
container:
name: ''
image: docker/whalesay:latest
command:
- sh
- '-c'
args:
- >-
echo generating message in volume; cowsay hello world | tee
/mnt/vol/hello_world.txt
volumeMounts:
- name: workdir
mountPath: /mnt/vol

entrypoint: volumes-pvc-example

volumeClaimTemplates:
- metadata:
name: workdir
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: rbd
```

### Logs from the workflow controller

```text
time="2023-12-13T07:24:20.931Z" level=info msg="Processing workflow" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.957Z" level=info msg="Task-result reconciliation" namespace=argo numObjs=0 workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.957Z" level=info msg="Updated phase -> Running" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.957Z" level=info msg="Creating pvc volumes-pvc-storage-class-name-2xpds-workdir" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.978Z" level=warning msg="Node was nil, will be initialized as type Skipped" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.979Z" level=info msg="was unable to obtain node for , letting display name to be nodeName" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.979Z" level=info msg="Steps node volumes-pvc-storage-class-name-2xpds initialized Running" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.979Z" level=info msg="StepGroup node volumes-pvc-storage-class-name-2xpds-3223504471 initialized Running" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.979Z" level=warning msg="Node was nil, will be initialized as type Skipped" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:20.979Z" level=info msg="Pod node volumes-pvc-storage-class-name-2xpds-2432720503 initialized Pending" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:21.014Z" level=info msg="Created pod: volumes-pvc-storage-class-name-2xpds[0].step-1 (volumes-pvc-storage-class-name-2xpds-step-1-2432720503)" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:21.014Z" level=info msg="Workflow step group node volumes-pvc-storage-class-name-2xpds-3223504471 not yet completed" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:21.015Z" level=info msg="TaskSet Reconciliation" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:21.015Z" level=info msg=reconcileAgentPod namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:21.060Z" level=info msg="Workflow update successful" namespace=argo phase=Running resourceVersion=614253889 workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.018Z" level=info msg="Processing workflow" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.019Z" level=info msg="Updated phase Running -> Error" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.019Z" level=info msg="Updated message -> WorkflowSpec may not change during execution when the controller is set `templateReferencing: Secure`" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.019Z" level=info msg="Marking workflow completed" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.019Z" level=error msg="Unable to set ExecWorkflow" error="WorkflowSpec may not change during execution when the controller is set `templateReferencing: Secure`" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.024Z" level=info msg="cleaning up pod" action=deletePod key=argo/volumes-pvc-storage-class-name-2xpds-1340600742-agent/deletePod
time="2023-12-13T07:24:31.046Z" level=warning msg="Error updating workflow: Operation cannot be fulfilled on workflows.argoproj.io \"volumes-pvc-storage-class-name-2xpds\": the object has been modified; please apply your changes to the latest version and try again Conflict" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.047Z" level=info msg="Re-applying updates on latest version and retrying update" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.070Z" level=info msg="Update retry attempt 1 successful" namespace=argo workflow=volumes-pvc-storage-class-name-2xpds
time="2023-12-13T07:24:31.070Z" level=info msg="Workflow update successful" namespace=argo phase=Error resourceVersion=614254021 workflow=volumes-pvc-storage-class-name-2xpds
```

### Logs from in your workflow's wait container

```text
time="2023-12-13T07:24:29.508Z" level=info msg="No output parameters"
time="2023-12-13T07:24:29.508Z" level=info msg="No output artifacts"
time="2023-12-13T07:24:29.521Z" level=warning msg="failed to patch task set, falling back to legacy/insecure pod patch, see https://argoproj.github.io/argo-workflows/workflow-rbac/" error="workflowtaskresults.argoproj.io is forbidden: User \"system:serviceaccount:argo:default\" cannot create resource \"workflowtaskresults\" in API group \"argoproj.io\" in the namespace \"argo\""
time="2023-12-13T07:24:29.523Z" level=warning msg="Non-transient error: pods \"volumes-pvc-storage-class-name-2xpds-step-1-2432720503\" is forbidden: User \"system:serviceaccount:argo:default\" cannot patch resource \"pods\" in API group \"\" in the namespace \"argo\""
time="2023-12-13T07:24:29.523Z" level=error msg="executor error: pods \"volumes-pvc-storage-class-name-2xpds-step-1-2432720503\" is forbidden: User \"system:serviceaccount:argo:default\" cannot patch resource \"pods\" in API group \"\" in the namespace \"argo\""
time="2023-12-13T07:24:29.523Z" level=info msg="Alloc=7503 TotalAlloc=13114 Sys=24677 NumGC=4 Goroutines=8"
time="2023-12-13T07:24:29.525Z" level=warning msg="failed to patch task set, falling back to legacy/insecure pod patch, see https://argoproj.github.io/argo-workflows/workflow-rbac/" error="workflowtaskresults.argoproj.io \"volumes-pvc-storage-class-name-2xpds-2432720503\" is forbidden: User \"system:serviceaccount:argo:default\" cannot patch resource \"workflowtaskresults\" in API group \"argoproj.io\" in the namespace \"argo\""
time="2023-12-13T07:24:29.526Z" level=warning msg="Non-transient error: pods \"volumes-pvc-storage-class-name-2xpds-step-1-2432720503\" is forbidden: User \"system:serviceaccount:argo:default\" cannot patch resource \"pods\" in API group \"\" in the namespace \"argo\""
time="2023-12-13T07:24:29.526Z" level=error msg="executor error: pods \"volumes-pvc-storage-class-name-2xpds-step-1-2432720503\" is forbidden: User \"system:serviceaccount:argo:default\" cannot patch resource \"pods\" in API group \"\" in the namespace \"argo\""
time="2023-12-13T07:24:29.526Z" level=fatal msg="pods \"volumes-pvc-storage-class-name-2xpds-step-1-2432720503\" is forbidden: User \"system:serviceaccount:argo:default\" cannot patch resource \"pods\" in API group \"\" in the namespace \"argo\""
```

Start at the workflow-controller handling of ClusterWorkflowTemplate execution when templateReferencing is set to Secure, using the supplied storageClassName reproduction and controller logs. Trace why the workflow is treated as changed after PVC creation; done means the reproduced workflow completes without the WorkflowSpec change error while Secure referencing remains enforced.

Written by the indexing model from the issue text.