switch Workload Identity grant to Prow's trusted cluster
switch Workload Identity grant to Prow's trusted cluster

This is a followup to https://github.com/kubernetes/test-infra/pull/16917.

The problem is that there are 2 completely separate Prow clusters, one
called k8s-prow-builds, which runs random presubmits from the public and
k8s-prow, which only runs trusted jobs. The ci-k8sio-cip job runs in the
trusted cluster, and so the Workload Identity grant must be for
"k8s-prow", not "k8s-prow-builds".

The incorrect grant to
"k8s-prow-builds.svc.id.goog[test-pods/k8s-artifacts-prod]" must
manually be removed.

thockin/k8s.io,kubernetes/k8s.io,kubernetes/k8s.io,thockin/k8s.io,thockin/k8s.io,thockin/k8s.io,kubernetes/k8s.io,kubernetes/k8s.io