[EKS] [request]: Set IRSA pod identity webhook to use same default expiration as OIDC endpoint

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

We've been informed that OIDC tokens issued by the EKS IDP expire after 1 hour while the pod-identity-webhook is configuring an expiration of 24 hours. We see that AWS clients are then attempting to use expired tokens because the tokens are not correctly rotated, nor refreshed by the client (the client could not write a refreshed token to the readonly file in any case).

Instead of adding annotation `eks.amazonaws.com/token-expiration: "3600"` to all uses of IRSA, we kindly request that the default expiration of pod-identity-webhook is synchronized with the OIDC IDP setting of 1 hour with the use of argument `--token-expiration 3600`

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

Adjusting many (10s/100s?) of annotations is measurably harder than changing one default setting. The OIDC token expiration is managed by AWS, not users, and we feel that the pod-identity-webhook (also managed by AWS) that directly and only uses the AWS-managed OIDC IDP should have corresponding configuration to ensure that tokens are rotated on the required schedule.

**Are you currently working around this issue?**
We will update all IRSA annotations to additionally set `eks.amazonaws.com/token-expiration: "3600"` because EKS Pod Identity does not meet our current use cases.

**Additional context**
https://github.com/aws/amazon-eks-pod-identity-webhook/tree/master

Start by inspecting the linked aws/amazon-eks-pod-identity-webhook repository and locate the configuration or entry point for --token-expiration. Confirm how the default expiration is set and whether related tests cover it. Done means the default matches the EKS OIDC endpoint's one-hour expiration without requiring annotations on every IRSA use.

Written by the indexing model from the issue text.