feat: add ServiceAccount inheritance to Affinity Assistants

[vdemeester]

Changes

This PR adds ServiceAccount inheritance to Affinity Assistant pods, resolving OpenShift SCC permission failures.

Changes:

• Added ServiceAccountName field to AffinityAssistantTemplate API
• Implemented 3-tier priority for ServiceAccount configuration:
  1. Explicit override from AffinityAssistantTemplate
  2. Inherit from PipelineRun's TaskRunTemplate (default)
  3. Empty string (Kubernetes defaults to "default")
• Updated affinity assistant StatefulSet creation to set ServiceAccountName
• Added comprehensive tests (5 test functions, 234 lines)
• Updated documentation in docs/affinityassistants.md and docs/pipelineruns.md

Motivation:
In OpenShift environments, pods are restricted by Security Context Constraints (SCC) based on their ServiceAccount. Previously, affinity assistant pods always used the namespace's "default" ServiceAccount, which often lacks required SCC permissions. This caused PipelineRuns with workspace coscheduling to fail in OpenShift.

By inheriting the PipelineRun's ServiceAccount by default, affinity assistants now automatically get appropriate permissions, making the feature work out-of-box in security-restricted environments.

Submitter Checklist

• Has Docs if any changes are user facing, including updates to minimum requirements
• Has Tests included if any functionality added or changed
• pre-commit Passed
• Follows the commit message standard
• Meets the Tekton contributor standards
• Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>
• Release notes block below has been updated with any user facing changes

Release Notes

Affinity Assistant pods now inherit the serviceAccountName from PipelineRun's taskRunTemplate by default, ensuring proper permissions in security-restricted environments like OpenShift with Security Context Constraints (SCC). This can be overridden via the AffinityAssistantTemplate if needed.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from vdemeester after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vdemeester]

/kind feature