Multi account setup with only one IAM role in k8s account

**What would you like to be added**:
The current situation is:
- shared K8S cluster in one AWS account
- Team A's pods need to access only team A's AWS account
- Team B's pods need to access only team B's AWS account

The possibility now:
- create IAM role in K8S account *for each team account*
- create IAM role in each team account trusting the k8s account role

Add feature to whitelist which role should be assumed in the namespace level.

**Why is this needed**:

What I want to avoid is to create multiple IAM roles in our K8S account, instead to have one role which should be trusted by all team accounts and then restrict which role to be assumed in the namespace level (That's the current concept in KIAM)

The issue names no files or tests. Start by tracing how namespace-level configuration and IAM role assumptions are represented, then determine how a single Kubernetes-account role could be restricted to approved roles in team accounts; done means the feature supports that restriction without requiring one Kubernetes-account role per team account.

Written by the indexing model from the issue text.