fix(rbac): add delete verb for networkpolicies to allow cleanup of stale and proxy egress NPs

The EP-1998 controller implementation calls r.Delete on NetworkPolicies in
two places: cleanupMigratedNetworkPolicies (pruning stale entries) and
createOrApplyProxyEgressNetworkPolicy (removing the policy when proxy is
not configured). Without delete permission, these calls fail with 403,
causing reconcile to abort before reaching createOrApplyDeployments. This
blocked the env var test from seeing LOG_LEVEL applied to the deployment.

Ref: openshift/enhancements#1998

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Ambient Code Bot

bundle/manifests/openshift-external-secrets-operator.clusterserviceversion.yaml

@@ -605,6 +605,7 @@ spec:
           - networkpolicies
           verbs:
           - create
+          - delete
           - get
           - list
           - update

config/rbac/role.yaml

@@ -181,6 +181,7 @@ rules:
   - networkpolicies
   verbs:
   - create
+  - delete
   - get
   - list
   - update

pkg/controller/external_secrets/controller.go

@@ -104,7 +104,7 @@ type Reconciler struct {
 // +kubebuilder:rbac:groups="",resources=events;secrets;services;serviceaccounts,verbs=get;list;watch;create;update;delete;patch
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update
 // +kubebuilder:rbac:groups=cert-manager.io,resources=certificates;clusterissuers;issuers,verbs=get;list;watch;create;update
-// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update
+// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;delete
 // +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch;create;update;patch
 
 // +kubebuilder:rbac:groups="",resources=endpoints,verbs=get;list;watch