ServiceAccount for Quay app pods deployed by TNG

The Quay app Deployment should use its own ServiceAccount, rather than the default one for the namespace. This allows setting different SecurityContextConstraints for that ServiceAccount (needed when running the Python2 branch).