feat: support service account token auth mode

Signed-off-by: hongming <coder.scala@gmail.com>

pkg/controller/rolebinding/rolebinding_controller.go

@@ -86,10 +86,12 @@ func (r *Reconciler) syncToKubernetes(ctx context.Context, roleBinding *iamv1bet
 		for _, subject := range roleBinding.Subjects {
 			newSubject := rbacv1.Subject{
 				Kind:      subject.Kind,
-				APIGroup:  rbacv1.GroupName,
 				Name:      subject.Name,
 				Namespace: subject.Namespace,
 			}
+			if subject.APIGroup != "" {
+				newSubject.APIGroup = rbacv1.GroupName
+			}
 			subjects = append(subjects, newSubject)
 		}
 		k8sRolBinding.Subjects = subjects