Run agent with own service account

# Summary

We should not use the workflows service account for the agent. Instead, we should have a way to use a different service account.

The agent pod needs different permissions to the workflows pod. It does not need `pod patch` and does need `patch workflowtaskset`. We should have a way to specify this account differently so we are not violated minimum permission principle.

Options:

1. Do nothing. Live with it. Same SA as workflow.
2. Label the agent SA. Same SA for all agents within namespace. Probably not what we always want.
3. New spec field `spec.agentServiceAccountName`.
4. A different configurable default, e.g. `argo-workflows-agent` rather than `default`.

# Use Cases

When would you use this?

---

**Message from the maintainers**:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

No files or tests are named. Start by locating the agent pod specification and the Kubernetes service-account and RBAC definitions for workflows; compare the permissions each pod needs. Done means the agent can use a separately configurable service account with only its required permissions, with coverage for the selected configuration.

Written by the indexing model from the issue text.