Add support for sa token volume projection in the admission charts

[dimityrmirchev]

How to categorize this PR?

/area security
/kind enhancement
/platform gcp

What this PR does / why we need it:
This PR adds:

• The ability to configure the admission deployment to use service account token volume projection (ref).
• The ability to configure a user instead of a service account subject in the clusterrolebinding definition when using a "virtual garden" setup. This will enable other possibilities for authentication to the virtual garden, i.e., leveraging oidc-webhook-authenticator.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:
If this gets approved I will open similar PRs for the other extensions.

Release note:

`gardener-extension-admission-gcp` now supports configuration for enabling service account token volume projection. It is exposed through the `.Values.global.serviceAccountTokenVolumeProjection` section in the respective chart's values.

It is now possible to configure a `user` instead of a `serviceaccount` subject in the `clusterrolebinding` for the `gardener-extension-admission-gcp` when using virtual garden setup by setting `.Values.global.virtualGarden.user.name`.

[gardener-robot]

@dimityrmirchev Label kind/feature does not exist.

[dimityrmirchev]

/invite @vpnachev @rfranzke @timebertt

[rfranzke]

/assign

[dimityrmirchev]

I left out the ability to configure an already existing "generic" kubeconfig for now as the current changes will not expand the etcd size. If this becomes something that we want to chase I can contribute it in a different set of PRs, but I guess for now priority is the actual functionality.

[dimityrmirchev]

Converted to draft since there are some changes still needed.

[vpnachev]

/lgtm