add KSA binding for workload identity for backup test job (pull-k8sio-backup)
add KSA binding for workload identity for backup test job (pull-k8sio-backup)

This lets the `k8s-infra-gcr-promoter-test` Kubernetes service account
in the `test-pods` Kubernetes namespace in the "k8s-prow-builds" GCP
project's GKE cluster authenticate as
`k8s-infra-gcr-promoter@k8s-gcr-backup-test-prod-bak.iam.gserviceaccount.com`.
This GCP SA has write access to the test-only GCRs for testing the
backup logic. This is a requirement for the `pull-k8sio8-backup` Prow
job that tests our backup_tools logic in infr/gcp/backup_tools.

This is a follow-up to #708 and #709.

thockin/k8s.io,thockin/k8s.io,thockin/k8s.io,kubernetes/k8s.io,thockin/k8s.io,kubernetes/k8s.io,kubernetes/k8s.io,kubernetes/k8s.io