fix(rbac): Add aggregation labels to the clusterrole

[ulrichgiraud]

Fixes #415

Motivation

The ClusterRole shipped by this chart does not carry any RBAC aggregation labels, so users or service accounts bound to the standard Kubernetes admin / edit ClusterRoles cannot manage the operator's CRDs (PulsarTenant, PulsarNamespace, PulsarTopic, ...) out of the box. Every consumer has to either add extra ClusterRoleBindings or patch the chart via post-rendering to inject the labels.

Modifications

Added the standard RBAC aggregation labels to the manager ClusterRole template:

metadata:
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"

This is the minimal change discussed in the linked issue. The optional companion read-only ClusterRole (aggregate-to-view) and the values.yaml toggles are intentionally left out of this PR, happy to follow up with a second PR based on maintainer feedback.

Verifying this change

• Make sure that the change passes the CI checks.

This change added tests and can be verified as follows:

helm unittest

• added minimal default tests on role and role_binding
• added a test on labels presence

Documentation

• no-need-doc

This change only affects the rendered RBAC manifests. It does not introduce new APIs, configuration values, or user-facing behaviour that would require documentation updates.

[github-actions]

@ulrichgiraud:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)