EPMDEDP-17305: fix: Reduce the operator's RBAC to the permissions it uses

[SergK]

Every grant is backed by a call site.

1. The chart ships no cluster-scoped RBAC. The ServiceAccount holds one namespaced Role and one RoleBinding.

2. Verbs are explicit per resource: secrets get;list;watch;update;delete; configmaps, quicklinks and triggertemplates get; ingresses, httproutes and routes get;create; cdpipelines and stages get;list; pipelineruns list;watch;create; eventlisteners get;create;patch; leases create;get;update; /status get;patch;update; /finalizers update.

3. The cache holds only Secrets labelled app.edp.epam.com/integration-secret, the one type a controller watches. Everything else is read live through client.Cache.DisableFor, so no informer starts and no list/watch is needed. DefaultTransform strips managedFields.

4. The kubebuilder markers are the single source of truth. controller-gen emits a namespaced Role only; both chart Roles mirror config/rbac/role.yaml and differ solely by the platform split.

5. The kustomize path mirrors the chart: manager-role bound by a RoleBinding, carrying leader-election leases and events, plus metrics-auth for the metrics endpoint that config/default enables.

[epmd-edp]

Pipeline r-review-codebase-operator-master-g8dbm-74be — ✓ Passed

Status	Task	Duration
✓ Passed	github-set-pending-status	25s
✓ Passed	fetch-repository	13s
✓ Passed	init-values	7s
✓ Passed	get-cache	2m5s
✓ Passed	commit-validate	6s
✓ Passed	dockerfile-lint	8s
✓ Passed	helm-lint	6s
✓ Passed	helm-docs	11s
✓ Passed	build	44s
✓ Passed	sonar	16s
✓ Passed	save-cache	7s
✓ Passed	buildkit-build	19s
✓ Passed	github-report-pipeline-status	7s

Pushing new commits re-runs this pipeline automatically.
To re-run it without new commits, comment /recheck.