fix(manifests): wire ambient-control-plane-rbac.yaml into mpp-openshift kustomization

The RBAC Role/RoleBinding granting the control-plane SA get/list/watch/create/delete
on tenantnamespaces.tenant.paas.redhat.com in ambient-code--config already existed
but was never referenced in kustomization.yaml, causing Forbidden errors when the
MPP provisioner tried to manage TenantNamespace CRs.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Ambient Code Bot

components/manifests/overlays/mpp-openshift/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
 - ambient-control-plane.yaml
 - ambient-api-server-route.yaml
 - ambient-control-plane-sa.yaml
+- ambient-control-plane-rbac.yaml
 - ambient-tenant-ingress-netpol.yaml
 
 patches: