Remove `automountServiceAccountToken` for main containers

# Summary

There's no reason to have this mounted for most tasks. In fact, main containers will get `pod patch` allowing the to change other pods within the namespace.

This might be easier than fixing #3961

Note, you now must explicitly mount the service account token, which has unpredicatable name.

# Use Cases

Better default security.

---

**Message from the maintainers**:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

Start by tracing how Argo Workflows constructs pods and handles automountServiceAccountToken for main containers. Read issue #3961 and Kubernetes service-account-token mounting behavior, then verify that automatic tokens are removed while explicit token mounts remain usable.

Written by the indexing model from the issue text.