if you create the service account ahead of time with the workload identity annotations, spicedb-operator won't overwrite them