Feature: Support IRSA/Workload Identity annotations on provider ServiceAccounts

## What would you like to be added?

Add support for ServiceAccount annotations in provider specs to enable IAM Roles for Service Accounts (IRSA) on EKS and Workload Identity on GKE without requiring external tools.

## Why is this needed?

### Current Problem

When running Cluster API providers on EKS with IRSA authentication, users must:

1. Deploy the provider via `InfrastructureProvider`
2. Wait for the ServiceAccount to be created
3. Use an external tool (Terraform, kubectl patch, etc.) to add IRSA annotations to the ServiceAccount
4. Restart the deployment to pick up the credentials

This workflow is:
- **Not declarative** - requires external state management
- **Error-prone** - timing issues between operator and external tools
- **Undocumented** - no official guidance for IRSA setup
- **Incompatible with GitOps** - cannot be managed purely through manifests

### Related PR

PR #174 added `serviceAccountName` to allow referencing a pre-created ServiceAccount, but this doesn't solve the problem when the operator manages the ServiceAccount lifecycle.

## Proposed Solution

Add `serviceAccountAnnotations` field to `DeploymentSpec`:

```yaml
apiVersion: operator.cluster.x-k8s.io/v1alpha2
kind: InfrastructureProvider
metadata:
name: aws
namespace: capa-system
spec:
version: v2.9.2
deployment:
serviceAccountAnnotations:
eks.amazonaws.com/role-arn: arn:aws:iam::123456789:role/CAPAController

No file or test is named in the issue. Start by tracing DeploymentSpec and the operator-managed ServiceAccount lifecycle, then compare the proposed serviceAccountAnnotations field with existing serviceAccountName handling. Done means provider specs can declaratively apply annotations for EKS IRSA and GKE Workload Identity, with coverage for the resulting behavior.

Written by the indexing model from the issue text.