Fix Celery worker service account in RBAC bindings

[bobu-putheeckal]

Fixes #67261.

What changed

This updates Celery worker RBAC subjects to resolve the worker service account name using workers.celery.serviceAccount with the same fallback behavior as the Celery worker templates.

The pod-launcher, job-launcher, and SCC role bindings now reference the custom Celery worker service account when users set workers.celery.serviceAccount.name. For hybrid Celery/Kubernetes executor deployments, the templates also keep the fallback Kubernetes worker service account subject when it differs from the Celery worker service account and no dedicated workers.kubernetes.serviceAccount is configured.

Tests

• uv run pytest tests/helm_tests/airflow_aux/test_pod_launcher_role.py tests/helm_tests/airflow_aux/test_job_launcher_role.py tests/helm_tests/security/test_scc_rolebinding.py
• helm lint chart
• helm template test chart --show-only templates/rbac/pod-launcher-rolebinding.yaml --set allowPodLaunching=true --set executor=CeleryExecutor --set workers.celery.serviceAccount.name=worker
• helm template test chart --show-only templates/rbac/job-launcher-rolebinding.yaml --set allowJobLaunching=true --set executor=CeleryExecutor --set workers.celery.serviceAccount.name=worker

[kaxil]

PR template hasn't been followed on any of your PRs. As such I am closing all your PRs since I see little to no evidence of actual testing and mass PRs to Airflow & other repos.