SELF_HOSTED_SETUP Document Correction

### APIServer Configuration
In [SELF_HOSTED_SETUP.md](https://github.com/geckofu/amazon-eks-pod-identity-webhook/blob/master/SELF_HOSTED_SETUP.md#kubernetes-api-server-configuration) it says you need to add `--service-account-key-file` with the path to the `$PKCS_KEY` file. I have tested with minikube 1.17 and a kops 1.15 cluster, here is the error message:

```
{"log":"Error: invalid authentication config: error reading public key file /var/lib/minikube/certs/sa-signing-pkcs.pub: data does not contain any valid RSA or ECDSA public keys\n","stream":"stderr","time":"2020-02-10T14:34:36.834045998Z"}
```

According to the [apiserver doc](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/), it should be the path to `$PUB_KEY`

Also the original public key may not be explictly specified by `--service-account-key-file` (using the default value same as `--tls-private-key-file`) so user needs to make sure it is included, otherwise existing tokens will fail: https://github.com/aws/amazon-eks-pod-identity-webhook/issues/29

### ControllerManager Configuration
It is missing from the doc that you should also configure controller managers:

> You must pass a service account private key file to the token controller in the controller-manager by using the --service-account-private-key-file option. The private key will be used to sign generated service account tokens. [Managing Service Accounts](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#token-controller)

Open SELF_HOSTED_SETUP.md at the Kubernetes API server configuration section and compare its service-account key guidance with the linked kube-apiserver documentation. Correct the public-key path guidance, mention preserving the original public key, and add the controller-manager private-key requirement; done means both setup sections accurately reflect the referenced Kubernetes guidance.

Written by the indexing model from the issue text.