[EKS]: allow EKS Pod Identity association to accept a glob for the service account name (my-sa-*)

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
What do you want us to build?

Enhance the EKS `create-pod-identity-association` API to accept a glob for the service account. There are cases where the service account is dynamically provided and will have the form my-sa-. I would like the ability to define the serviceAccount name in this case as "my-sa-*" in the `create-pod-identity-association` call.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
This will enable EKS pod identity to be used in cases where the service account name is being managed by another controller on the cluster.

**Are you currently working around this issue?**
We can continue to use IRSA with a trust policy that includes a condition and StringLike operator and statement like `"${ISSUER_HOSTPATH}:sub": "system:serviceaccount:default:my-sa-*"`

Start with the EKS create-pod-identity-association API described in the request and compare it with the stated IRSA trust-policy workaround. Done means the association accepts a glob such as "my-sa-*" for dynamically named service accounts.

Written by the indexing model from the issue text.