Use tempo service account for accessing user-workload monitoring stack

[pavolloffay]

The #470 adds support for the monitor tab and on OpenShift it uses thanos-query as the metrics store.

On OpenShift the #470 requires that a user creates ClusterRoleBinding to give user permission to query metrics from Thanos e.g. The user token is sent to Thanos (instead of tempo-query SA) because --query.bearer-token-propagation=true is set on tempo-query.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jaeger-cluster-monitoring-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-monitoring-view
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: system:authenticated
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: system:unauthenticated  

The proposal is to send tempo SA as token to Thanos and let the operator to create the binding:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tempo-cluster-monitoring-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-monitoring-view
subjects:
  - kind: ServiceAccount
    name: tempo-simplest
    namespace: ploffay

This will as well require change on Jaeger codebase to make sure Tempo token is set even when --query.bearer-token-propagation=true is set - see https://github.com/jaegertracing/jaeger/blob/9c787fca2dfcbe4182de85d34f36ba6cd18bbb7e/plugin/metrics/prometheus/metricsstore/reader.go#L323