Update KubeExecutor pod templates to allow access to IAM permissions (#15669)

If AWS's Identity-based IAM policies are in use on the cluster they
token file will be mounted in to the pod (via the service account) and,
prior to this change, will be owned by root.

Specifying `fsGroup` makes the file group-readable by the `airflow`
user.

We already specify this in our helm chart, so this change is just for
anyone looking at the docs.

airflow/kubernetes/pod_template_file_examples/dags_in_image_template.yaml

@@ -65,6 +65,7 @@ spec:
   restartPolicy: Never
   securityContext:
     runAsUser: 50000
+    fsGroup: 50000
   nodeSelector:
     {}
   affinity:

airflow/kubernetes/pod_template_file_examples/dags_in_volume_template.yaml

@@ -62,6 +62,7 @@ spec:
   restartPolicy: Never
   securityContext:
     runAsUser: 50000
+    fsGroup: 50000
   nodeSelector:
     {}
   affinity:

airflow/kubernetes/pod_template_file_examples/git_sync_template.yaml

@@ -86,6 +86,7 @@ spec:
   restartPolicy: Never
   securityContext:
     runAsUser: 50000
+    fsGroup: 50000
   nodeSelector:
     {}
   affinity: