Use of workload_identity_enabled and move container label

[loresuso]

I don't know if I am right but this worked for me, you can entirely remove the helm module and use workload_identity_enabled when creating the cluster
See here:
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#workload_identity_enabled
This should automatically enable workload identity e.g. by deploying the necessary mutating webhook

The other point is that the azure label should be put in the container in my opinion, not the service account:
https://github.com/epomatti/azure-workload-identity-terraform/blob/main/kubernetes/main.tf#L72
pretty much like here:
https://learn.microsoft.com/en-us/azure/aks/learn/tutorial-kubernetes-workload-identity#deploy-the-workload
(as you can see the label is in metadata of the pod definition). In this way, the mutating webhook will understand to inject the azure token + all the required env variables