Allow RO permissions for cluster maintenance config

[bernardjkim]

Closes #41027

This PR adds cluster_maintenance_config read only permissions to the preset access role.

❯ tctl get cmc
kind: cluster_maintenance_config
metadata:
  name: cluster-maintenance-config
nonce: 28658
spec:
  agent_upgrades:
    utc_start_hour: 16
version: v1

changelog: Add read-only permissions for cluster maintenance config

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[zmb3]

Does this work even on a cluster where access already exists?

[strideynet]

Does this work even on a cluster where access already exists?

My understanding is that services.AddRoleDefaults manages adding new resources to the default roles.

[bernardjkim]

Does this work even on a cluster where access already exists?

Just tested, it looks like, yes, existing access roles will be updated after the auth is re-initialized. From what I can tell this is only for the preset roles though https://github.com/gravitational/teleport/blob/master/lib/auth/init.go#L918

[public-teleport-github-review-bot]

@bernardjkim See the table below for backport results.

Branch	Result
branch/v13	Create PR
branch/v14	Create PR
branch/v15	Create PR