improve/fix disable-automountserviceaccounttoken Kyverno policy

@alain.thioliere pointed out to me that for each matched ServiceAccount, the policy mutates all default ServiceAccounts, which of course is bogus...

This is harmless because since the goal of this policy is to match all default ServiceAccounts, the result is ultimately the same.

But it's not efficient.

This MR fixes that...