add helper function for creating iam service account

[Rob-Johnson]

copies the implementation added by @JoeMalt for the flink operator, and moves it to paasta-tools-go.

caveat: I've removed the 'prefix' thing from the original implementation, given this is already namespaced.

also added a helper function for getting the object hash from a k8s object, given you currently have to access the correct label directly.

open question: should we try and add/delete the service account if the object hash doesn't match (currently we're just looking if one with a matching name exists)?

[vkhromov]

caveat: I've removed the 'prefix' thing from the original implementation, given this is already namespaced.

The prefix is used in paasta-tools code to reduce a chance to have name collision between generated-for-iam-roles SA names and some other SA names, so it's better to have the same prefix here as well.

also added a helper function for getting the object hash from a k8s object, given you currently have to access the correct label directly.

open question: should we try and add/delete the service account if the object hash doesn't match (currently we're just looking if one with a matching name exists)?

Why we need the hash in the first place?

Overall, I planned to move https://github.yelpcorp.com/services/flink-operator/blob/master/pkg/cluster/common.go#L48 into paasta-tools-go as well, and remove all implementation-specific details from the operator code, so it would just call functions like Init and ModifyPodForIamRole. For that, EnsureServiceAccountForIamRole will become that Init and will abstract most of its arguments.