In-place update of Service Account permissions once IAM Policy changes

**What would you like to be added**:

Service Account permissions should be updated in place once IAM Policies associated with Service Account-bound IAM Role change. That'd probably mean resetting Pod's access token if I'm not mistaken?

**Why is this needed**:

Currently we need to restart the Pod once there are changes to relevant IAM Policies. That'd be great if this change was picked up automatically. As a side question - are there any workarounds other than restarting Pods? One more solution I can think of is making the token expiration time shorter. Anything else that I've missed?

Start by examining how the webhook handles Service Account-bound IAM Roles and injects Pod access tokens. Clarify whether IAM Policy changes can be observed without restarting Pods, and define completion around permissions taking effect automatically or documenting the supported workaround.

Written by the indexing model from the issue text.