chore: Describe RBAC rules, remove unnecessary rules

[NickLarsenNZ]

Part of stackabletech/issues#798

Note

This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.

• Document each rule
• Check the docs make sense. Rewrite where necessary
• Remove unnecessary permissions
• Attach explanations to PR description
• Run all tests
• Split operator and product roles into separate files

Removed permissions (operator role)

Resource	Verb(s) removed	Reason
endpoints	create, delete, get, list, patch, update, watch	Never managed by the operator. Kubernetes auto-creates Endpoints for Services; the operator never creates Endpoints objects directly.
pods	create, delete, get, list, patch, update, watch	Never managed directly. StatefulSets implicitly create pods — the operator only creates the StatefulSet.
configmaps	update	client.update() (HTTP PUT) is never called. All writes use client.apply_patch() (SSA = HTTP PATCH).
serviceaccounts	update	Same reason as above.
services	update	Same reason as above.
rolebindings	update	Same reason as above.
statefulsets	update	Same reason as above.
poddisruptionbudgets	update	Same reason as above.
opensearchclusters	patch	The operator never SSA-patches the primary CRD object. The spec is user-owned; only the status subresource is written (covered by the separate opensearchclusters/status rule).
nodes	list, watch	Not used for cluster domain lookup
customresourcedefinitions	get	Not needed for CRD maintenance

Removed permissions (product role)

Resource	Verb(s) removed	Reason
events	create, patch	The operator manages events, not the product
configmaps, secrets, serviceaccounts	get	Not used, appears to be from copy/paste

[NickLarsenNZ]

--- PASS: kuttl/harness/ldap_opensearch-3.4.0_opensearch_home-_stackable_opensearch (126.08s)
--- PASS: kuttl/harness/security-config_opensearch-3.1.0 (166.31s)
--- PASS: kuttl/harness/ldap_opensearch-3.1.0_opensearch_home-_stackable_opensearch (68.61s)
--- PASS: kuttl/harness/security-disabled_opensearch-3.4.0_opensearch_home-_stackable_opensearch (55.26s)
--- PASS: kuttl/harness/security-disabled_opensearch-3.1.0_opensearch_home-_stackable_opensearch (45.18s)
--- PASS: kuttl/harness/backup-restore_opensearch-3.4.0_s3-use-tls-true_release-0.0.0-dev (188.46s)
--- PASS: kuttl/harness/backup-restore_opensearch-3.1.0_s3-use-tls-true_release-0.0.0-dev (168.73s)
--- PASS: kuttl/harness/logging_opensearch-3.4.0 (77.54s)
--- PASS: kuttl/harness/logging_opensearch-3.1.0 (66.85s)
--- PASS: kuttl/harness/smoke_opensearch-3.4.0_opensearch_home-_stackable_opensearch_server-use-tls-true (70.28s)
--- PASS: kuttl/harness/smoke_opensearch-3.4.0_opensearch_home-_stackable_opensearch_server-use-tls-false (69.23s)
--- PASS: kuttl/harness/smoke_opensearch-3.1.0_opensearch_home-_stackable_opensearch_server-use-tls-true (69.66s)
--- PASS: kuttl/harness/smoke_opensearch-3.1.0_opensearch_home-_stackable_opensearch_server-use-tls-false (132.85s)
--- PASS: kuttl/harness/opensearch-dashboards_opensearch-3.4.0_opensearch_home-_stackable_opensearch_server-use-tls-true_release-0.0.0-dev (172.94s)
--- PASS: kuttl/harness/opensearch-dashboards_opensearch-3.4.0_opensearch_home-_stackable_opensearch_server-use-tls-false_release-0.0.0-dev (132.96s)
--- PASS: kuttl/harness/opensearch-dashboards_opensearch-3.1.0_opensearch_home-_stackable_opensearch_server-use-tls-true_release-0.0.0-dev (163.13s)
--- PASS: kuttl/harness/opensearch-dashboards_opensearch-3.1.0_opensearch_home-_stackable_opensearch_server-use-tls-false_release-0.0.0-dev (129.97s)
--- PASS: kuttl/harness/external-access_opensearch-3.4.0_opensearch_home-_stackable_opensearch (56.63s)
--- PASS: kuttl/harness/external-access_opensearch-3.1.0_opensearch_home-_stackable_opensearch (47.54s)
--- PASS: kuttl/harness/metrics_opensearch-3.4.0 (91.75s)
--- PASS: kuttl/harness/metrics_opensearch-3.1.0 (105.56s)
--- PASS: kuttl/harness/security-config_opensearch-3.4.0 (166.22s)

[xeniape]

Just a question, otherwise LGTM