IAM role alias

**What would you like to be added**:

If role aliasing (see [IoT IAM](https://docs.aws.amazon.com/iot/latest/developerguide/security_iam_service-with-iam.html) for details on role aliases) comes to be rolled out to broader AWS, I would like to be able to use a role alias rather than a full role ARN when annotating a service account / pod with an IAM role.

**Why is this needed**:

This would be useful for reducing automation code in the following scenario.

You have multiple AWS accounts, each with kubernetes cluster(s) running for any given business reason (departments, multi-tenancy, etc.).

Using a centralised CI system, you have one application that you wish to deploy to a number of clusters in separate accounts. Each instance of this application will need to interact with the AWS account it is deployed in, and will need an AWS role in each account accordingly.

Currently the deployment pipeline for said application would look something like:

1. test / build
2. get / create / interpolate role for the application to use on deployment
3. package
4. deploy
5. test / verify / notify

This pipeline could be simplified by the requested feature if you know ahead of time that a role of a given alias will always exist in the target accounts, then there is no need to interpolate account ID.

Start by reading the linked AWS IoT IAM role-alias documentation and reviewing the webhook's current service-account and pod role annotation behavior. Done means a role alias can be supplied instead of a full role ARN without account-ID interpolation, with the behavior verified for deployments across separate AWS accounts.

Written by the indexing model from the issue text.