Readiness Gate

**What would you like to be added**:

It would be nice to have [a readiness gate](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-readiness-gate) that checks if the AWS role defined in the service account was successfully picked up by the webhook for the pod using that service account. This would make a pod only become `Ready` if it actually has the required environment variables and token mount set. It would be even nicer if the webhook could react automatically to such a failed condition and update the env vars and mount accordingly for said pod.

**Why is this needed**:

This makes sure that pods won't become `Ready` without the required environment variables and mount added by the webhook. For example when running a single pod for the webhook and that pod is being rescheduled, there is a gap where pods can be created without the webhook catching the creation events and thus without getting the required env vars and mount.

Start with the linked Kubernetes Pod readiness gate documentation and trace how this webhook handles pod creation events and service-account roles. Done means pods cannot become Ready without the webhook-provided environment variables and token mount, with the requested recovery behavior for missed events defined and verified.

Written by the indexing model from the issue text.