Decouple IAM Role conditions from kubernetes IdP details

**What would you like to be added**:
I'd like to decouple the IAM roles' trust policy from kubernetes cluster details, while maintaining the service account level access controls.

The condition looks like
```
"StringEquals": {
"oidc.eks.us-west-1.amazonaws.com/id/ABCDEFGHIJKL:sub": "system:serviceaccount:kube-system:my-service-account"
}
```
There is no way to replace `ABCDEFGHIJKL` with `*` in this.
Removing it entirely allows any pod to assume the role.

It would be great if there was identical condition key like `subject`, that did not contain which IdP it was from.

Alternatively, it would be great to allow each EKS to set it's own `subject` prefix, so that we can target a subset of clusters that should have access (e.g. `"production:subject": "system:serviceaccount:kube-system:my-service-account`)

**Why is this needed**:

This is needed when we have many clusters and roles, some of which are ephemeral.

Start by tracing how IAM role trust policies and service-account subject conditions are generated for EKS clusters. Compare the two proposed approaches, then define how cluster identity can be decoupled while retaining service-account-level access controls; done means the behavior is covered for multiple, including ephemeral, clusters.

Written by the indexing model from the issue text.