[EKS] [Request]: Pod individual container support for IAM roles

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Currently, when you assign an AWS IAM role to a Kubernetes service account, all of the containers in the pod inherit the role's privileges. In order to apply the principal of least privilege and to potentially assign different IAM permissions to each container in a pod, it would help to allow applying a specific IAM role to only the specified containers, instead of the entire pod.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
For example, we have a use case where we use an init container to copy some data from S3 into the local pod volume from which then the main container uses to perform its work. We don't necessarily want the main container to have the IAM permissions because it is what we consider an untrusted container within the pod (we can provide more details if it helps).

**Are you currently working around this issue?**
As a workaround, we currently provision an IAM user and only pass the IAM credentials to the init container, but would prefer, as to AWS's recommendations, to use an IAM role to avoid having to manage an IAM user for this purpose.

**Additional context**
The Kubernetes maintainers currently do not want to add/prioritize work on adding a container level field of "ServiceAccountName", see https://github.com/kubernetes/kubernetes/issues/66020, so I can see this feature being developed for the https://github.com/aws/amazon-eks-pod-identity-webhook where it recognizes some pod annotation that describes which containers can use which AWS IAM roles. There is also a similar request in that repo for this feature: https://github.com/aws/amazon-eks-pod-identity-webhook/issues/63

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Start by reading the linked Kubernetes issue 66020 and the related amazon-eks-pod-identity-webhook issue 63 to determine where container-specific IAM role support belongs. Define the annotation and webhook behavior needed to assign roles only to selected containers, while preserving the init-container S3 use case and preventing untrusted containers from inheriting permissions.

Written by the indexing model from the issue text.