Allow setting securityContext.fsGroup to workaround IRSA

[yorinasub17]

Describe the bug

IAM Role for Service Accounts has a bug where non-root Docker containers are not able to read the kubernetes token when it is projected due to file permissions. To work around this, you need to be able to configure the fsGroup property. See aws/amazon-eks-pod-identity-webhook#8 for more information.

To Reproduce
Use k8s-service helm chart with IAM Role for Service Accounts using Kubernetes version <1.19, and a docker container that does not run as root.

Expected behavior
The container can assume the bound IAM Role.

Actual behavior
The container is not able to assume the bound IAM Role.

[yorinasub17]

Ah this is actually already supported