Add eks.amazonaws.com/include-containers annotation

[rittneje]

What would you like to be added:

Add support for a eks.amazonaws.com/include-containers. It is a comma-separated list of container names into which the token and env vars will be injected. Other containers will not be modified. If specified, then eks.amazonaws.com/skip-containers is ignored.

Why is this needed:

Building up a negative list for eks.amazonaws.com/skip-containers is cumbersome, as we have to account for all sidecars being injected by other webhooks. Typically we only have one "main" container that needs the credentials, so it would be a lot simpler to just put its name.

[james-callahan]

This would be awesome as a label to use with the webhook for objectSelector: it would mean a way to opt-in pods to the webhook, possibly with a failurePolicy: Fail.