Update authentication documentation

[smcavallo]

Update authentication documentation with serviceAccount recommendation for provider upgrade
Signed-off-by: smcavallo smcavallo@hotmail.com

Description of your changes

We use pod-iam which requires assigning the service account name to the aws role. The problem is that the service account name is the provider-aws revision and it changes during the release, breaking crossplane permissions
Ex. v.0.16.0 - provider-aws-6b36ca882d8e and v.0.17.0 - provider-aws-4ebd5d8c7cb7
Using a static StringEquals condition with a hard coded provider will break when the SERVICE_ACCOUNT_NAME changes when the provider is upgraded

"StringEquals": {
          "${OIDC_PROVIDER}:sub": "system:serviceaccount:${SERVICE_ACCOUNT_NAMESPACE}:${SERVICE_ACCOUNT_NAME}"
        }

This condition can be avoided by using an alternative IAM policy which uses StringLike and a wildcard SERVICE_ACCOUNT_NAME:

"StringLike": {
          "${OIDC_PROVIDER}:sub": "system:serviceaccount:${SERVICE_ACCOUNT_NAMESPACE}:provider-aws-*"
        }

This trust policy would cover both service account names - provider-aws-6b36ca882d8e and provider-aws-4ebd5d8c7cb7
As long as provider-aws- will not change as part of a release the above should cover future cases of provider names changing during a release without needing to update the role trust policy.

Fixes #

I have:

• Read and followed Crossplane's contribution process.
• Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

[hasheddan]

Thanks so much @smcavallo! This looks great, one nitpick below and I think you need DCO as well.