add additional workload-identity role-bindings

[rob-1126]

One of our VIP customers wanted more information about the service-accounts and a listing of all those that might need xcom access. This updates our previously incomplete list and adds a bit more detail to make this VIP happy.