Allow setting automountServiceAccountToken

[Aransh]

What does this PR do?

By default, kubernetes enables "automountServiceAccountToken" for all pods, see https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting.
This poses a security risk, as pods might get kube-api permissions unintentionally.
More specifically, this fails security compliance tests:
https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies
https://www.azadvertizer.net/azpolicyadvertizer/kubernetes_block-automount-token.html

Solution - Disable "automountServiceAccountToken", create projected volume for the token, and mount it on relevant containers

Submitter checklist

• I bumped the "version" key in ./charts/jenkins/Chart.yaml.
• I added a new changelog entry to ./charts/jenkins/CHANGELOG.md.
• I followed the technical requirements.
• I ran .github/helm-docs.sh from the project root.

Special notes for your reviewer

This does not effect default behavior, though if someone is looking to comply with security requirements and disable this, they must also manually mount the serviceAccount token, with the following values.yaml:

serviceAccount:
  automountServiceAccountToken: false
persistence:
  volumes:
    - name: kube-api-access
      projected:
        defaultMode: 420
        sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              items:
                - key: ca.crt
                  path: ca.crt
              name: kube-root-ca.crt
          - downwardAPI:
              items:
                - fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.namespace
                  path: namespace
  mounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access
      readOnly: true
controller:
  sidecars:
    configAutoReload:
      additionalVolumeMounts:
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: kube-api-access
          readOnly: true

[malki-akamai]

+1

[timja]

Thanks