controller: hypershift: relax configmap rbac rules

On HyperShift, we need to read configmaps from different
namespaces, namely from the `openshift-config-managed` namespace.

The only viable option is to move back the ConfigMap read
permission as cluster role, while keeping the write/mutation
permission as namespaced role.

Ideally, we would have injected a specific role+rolebinding
in the manifest bundle, but turns out that OLM always overwrites
the namespace in the namespaced manifests (and that would perfectly
make sense) so we cna't add permissions about a different namespace.

AI-attribution: AIA PAI Ce Hin R claude-4.6-opus-1M v1.0
Signed-off-by: Francesco Romani <fromani@redhat.com>

Author: ffromani

internal/controller/kubeletconfig_controller.go

@@ -86,8 +86,9 @@ type kubeletConfigHandler struct {
 }
 
 // Namespace Scoped
-//+kubebuilder:rbac:groups="",resources=configmaps,verbs=create;delete;get;list;update;watch,namespace="numaresources"
+//+kubebuilder:rbac:groups="",resources=configmaps,verbs=create;delete;update,namespace="numaresources"
 // Cluster Scoped
+//+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch
 //+kubebuilder:rbac:groups=machineconfiguration.openshift.io,resources=kubeletconfigs,verbs=get;list;watch
 //+kubebuilder:rbac:groups=machineconfiguration.openshift.io,resources=kubeletconfigs/finalizers,verbs=update