Ability to extract namespace and/or service account name to use as variable in policy

**What would you like to be added**:
I want to provide pods using a specific service account to read/write to an S3 folder name that is derived from either the namespace or the service account name.
For example, creating IAM role with the following policy:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*Object"
],
"Resource": "arn:aws:s3:::/${oidc.eks..amazonaws.com/id/.amazonaws.com/id/:` and I want to somehow extract only the namespace or service account name and use that as the folder prefix.

If I was able to substring the `sub` to its different sections that would provide me with what I need.
For example:
`${OIDC_PROVIDER}:sub": "system:serviceaccount::`
`${OIDC_PROVIDER}:sub:namespace": "`
`${OIDC_PROVIDER}:sub:serviceaccount": "`

**Why is this needed**:
Provide a single role that can serve multiple service accounts (I have thousands and I would hit the role limit quota if I will create a dedicated role per service account)

No repository files, tests, or entry points are identified in the issue. Start by checking the AWS IAM policy example and whether the OIDC `sub` claim can be parsed into namespace or service-account components; done means defining a supported way to derive the S3 folder prefix for multiple service accounts without separate roles.

Written by the indexing model from the issue text.