chore: Describe RBAC rules, remove unnecessary rules

[NickLarsenNZ]

Part of stackabletech/issues#798

Note

This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.

• Document each rule
• Check the docs make sense. Rewrite where necessary
• Remove unnecessary permissions
• Attach explanations to PR description
• Run all tests
• Split operator and product roles into separate files Core operators don't have product roles

Operator ClusterRole permission removals

• truststores: removed create and patch
  • They were conditionally granted via the
    {{- if .Values.maintenance.customResourceDefinitions.maintain }} gate when truststores shared a rule block with secretclasses). The operator only reconciles existing TrustStores and never creates or patches them.

[NickLarsenNZ]

--- PASS: kuttl/harness/tls_openshift-false_rsa-key-length-2048_custom-secret-names-False (16.22s)
--- PASS: kuttl/harness/cert-manager-tls_openshift-false (55.21s)
--- PASS: kuttl/harness/kerberos_krb5-1.21.1_openshift-false (71.63s)
--- PASS: kuttl/harness/tls_openshift-false_rsa-key-length-3072_custom-secret-names-True (17.24s)
--- PASS: kuttl/harness/listener_openshift-false (26.98s)
--- PASS: kuttl/harness/tls_openshift-false_rsa-key-length-3072_custom-secret-names-False (30.41s)
--- PASS: kuttl/harness/non-sensitive-data (45.84s)
--- PASS: kuttl/harness/tls-truststore_openshift-false_truststore-target-kind-Secret (9.00s)
--- PASS: kuttl/harness/tls-truststore_openshift-false_truststore-target-kind-ConfigMap (7.79s)
--- PASS: kuttl/harness/tls_openshift-false_rsa-key-length-2048_custom-secret-names-True (14.05s)