Use dedicated service account, fix RBAC

[cPu1]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

• squashed commits
• includes documentation
• includes emoji in title
• adds unit tests
• adds or updates e2e tests

Release note:

[spectro-prow]

@cPu1: The label(s) kind/feature cannot be applied, because the repository doesn't have them

Details

In response to this:

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

• squashed commits
• includes documentation
• includes emoji in title
• adds unit tests
• adds or updates e2e tests

Release note:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[spectro-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cPu1
To complete the pull request process, please assign after the PR has been reviewed.
You can assign the PR to them by writing /assign in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bulwark-spectrocloud]

⚠️ GoVulnCheck scan found vulnerabilities:

1. GO-2025-3553
   • Module: github.com/golang-jwt/jwt/v4
   • Found in: v4.5.1
   • Fixed in: v4.5.2
   • Example Traces:
     1. pkg/rosa/client.go:51:70: rosa.NewOCMClient calls ocm.Build, which eventually calls authentication.Build
2. GO-2025-4123
   • Module: github.com/dvsekhvalnov/jose2go
   • Found in: v1.6.0
   • Fixed in: v1.7.0
   • Example Traces:
     1. pkg/rosa/client.go:51:70: rosa.NewOCMClient calls ocm.Build, which eventually calls keyring.Get

Please review these findings and fix the issues before merging.

[bulwark-spectrocloud]

⚠️ GoSec scan found code issues:

1. G401: Use of weak cryptographic primitive, Severity: MEDIUM
   • 1. File: /home/runner/work/bulwark/bulwark/target-repo/pkg/cloud/services/eks/iam/iam.go:532:13
2. G505: Blocklisted import crypto/sha1: weak cryptographic primitive, Severity: MEDIUM
   • 1. File: /home/runner/work/bulwark/bulwark/target-repo/pkg/cloud/services/eks/iam/iam.go:22:2

Please review these findings and fix the issues before merging.