chore: Describe RBAC rules, remove unnecessary rules

[NickLarsenNZ]

Part of stackabletech/issues#798

Note

This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.

• Document each rule
• Check the docs make sense. Rewrite where necessary
• Remove unnecessary permissions
• Attach explanations to PR description
• Run all tests
• Split operator and product roles into separate files Core operators don't have product roles

Removed rules/verbs:

• listeners update removed - No client.update() calls exist in the codebase. All mutation uses apply_patch (SSA) or merge_patch, which only require patch.
• listeners/finalizers entire resource removed - No finalizer management exists in the operator code. The kube-rs Controller does not add finalizers automatically. Added in commit b2559c3 but never used.
• listeners/status create, delete, update removed - Status subresources only need patch (via client.apply_patch_status()). create, delete, and update on a subresource are not meaningful here.
• podlisteners delete, update removed - PodListeners is not in delete_orphaned_resources and there are no client.delete::<PodListeners>() calls. update is unused for the same reason as listeners.

[NickLarsenNZ]

--- PASS: kuttl/harness/overrides (6.59s)
--- PASS: kuttl/harness/custom-lbclass_openshift-false_loadbalancer-allocatenodeports-false (7.80s)
--- PASS: kuttl/harness/custom-lbclass_openshift-false_loadbalancer-allocatenodeports-true (7.66s)
--- PASS: kuttl/harness/smoke-nodeport_openshift-false_addressType-Hostname (33.52s)
--- PASS: kuttl/harness/smoke-nodeport_openshift-false_addressType-IP (26.53s)
--- PASS: kuttl/harness/smoke-nodeport_openshift-false_addressType-HostnameConservative (27.58s)

[razvan]

lgtm