clusters/hive: Grant cincinnati-ci-admins cluster-reader-extended

Hive is the host-cluster for the
release-openshift-origin-installer-launch-hypershift-hosted job, using
the s hypershift-hosted workflow, and accessible from Cluster Bot via
'launch 4.13.0-rc.0', etc.  Folks developing an operator so it works
more closely with HyperShift's HostedClusterController can open
parallel pull requests and have Cluster Bot launch a HostedCluster on
Hive that mixes the pulls together with:

  launch openshift/hypershift#nnn,openshift/cluster-version-operator#nnn

By granting cluster-reader-extended to the folks in the
cincinnati-ci-admins Rover group, they can then access the Hive
management cluster and check on HostedClusterController state and
controller logs and such.  Once work on [1] has completed, this access
may be revoked.

An alternative we considered was having Cincinnati admins install a
Cluster-Bot bot cluster to serve as a management cluster, but there
are a number of steps needed to set that up [2], and it seems easier
for this epic's development to temporarily extend access to Hive's
existing deployment.

[1]: https://issues.redhat.com/browse/OTA-924
[2]: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.7/html/clusters/cluster_mce_overview#hosting-service-cluster-configure-aws

clusters/hive/admin_cluster-reader-extended_clusterrolebinding.yaml

@@ -0,0 +1,29 @@
+kind: List
+apiVersion: v1
+items:
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  metadata:
+    annotations:
+      openshift.io/description: This cluster role has read-only access to all objects
+    name: cluster-reader-extended
+  rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - get
+    - list
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRoleBinding
+  metadata:
+    name: cluster-reader-extended
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: cluster-reader-extended
+  subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: cincinnati-ci-admins