Allow Hooks to run as a Custom ServiceAccount

[J12934]

Some hooks (e.g. DeclarativeCombinedScan Hook) need additional RBAC roles to be able to access other resources in the cluster. The serviceAccount used to run hooks is restricted to only allow access to the resources all hooks need access to.

Hooks should be able to override their default service account and use a custom service account with the RBAC rules required by them.

This should also remove the "create" role for the hook service account, which was added as a temp workaround.