chore: Describe RBAC rules, remove unnecessary rules

[NickLarsenNZ]

Part of stackabletech/issues#798

Note

This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.

• Document each rule
• Check the docs make sense. Rewrite where necessary
• Remove unnecessary permissions
• Attach explanations to PR description
• Run all tests
• Split operator and product roles into separate files

Operator ClusterRole

• nodes list/watch - not needed; only nodes/proxy get is required (for cluster domain detection)
• pods get/list/create/delete/patch/update/watch - operator does not manage Pod objects directly (StatefulSets handle that)
• secrets get/list/create/delete/patch/update/watch - operator does not create or manage Secrets
• endpoints get/list/create/delete/patch/update/watch - operator does not manage Endpoints
• batch/jobs get/list/create/delete/patch/update/watch - operator does not create Jobs
• update verb on configmaps, services, serviceaccounts, rolebindings, statefulsets, poddisruptionbudgets - not needed; the operator uses Server-Side Apply (patch), not update
• watch verb on rolebindings, poddisruptionbudgets - operator does not watch these resources
• get verb on customresourcedefinitions - not needed; operator only needs list/watch (startup condition) and create/patch (CRD maintenance)
• watch verb on listeners - operator does not watch Listener objects

Product ClusterRole

• configmaps/secrets/serviceaccounts get - ZooKeeper pods do not read these via the Kubernetes API; configuration is mounted into the container by the kubelet
• events.k8s.io/events create/patch - ZooKeeper pods do not emit Kubernetes events

[NickLarsenNZ]

--- PASS: kuttl/harness/delete-rolegroup_zookeeper-3.9.4_openshift-false (60.92s)
--- PASS: kuttl/harness/smoke_zookeeper-3.9.4_use-server-tls-false_use-client-auth-tls-false_openshift-false (84.75s)
--- PASS: kuttl/harness/logging_zookeeper-3.9.4_openshift-false (71.06s)
--- PASS: kuttl/harness/smoke_zookeeper-3.9.4_use-server-tls-true_use-client-auth-tls-true_openshift-false (104.61s)
--- PASS: kuttl/harness/smoke_zookeeper-3.9.4_use-server-tls-true_use-client-auth-tls-false_openshift-false (96.59s)
--- PASS: kuttl/harness/smoke_zookeeper-3.9.4_use-server-tls-false_use-client-auth-tls-true_openshift-false (103.01s)
--- PASS: kuttl/harness/znode_zookeeper-latest-3.9.4_openshift-false (33.59s)
--- PASS: kuttl/harness/cluster-operation_zookeeper-latest-3.9.4_openshift-false (42.85s)