Grant /status RBAC for ManagedCluster and PacketCapture

[caseydavenport]

calico-private https://github.com/tigera/calico-private/pull/11977 routes voltron's ManagedCluster status writes and kube-controllers' PacketCapture status writes through the /status subresource. Without matching RBAC, both clients get 403'd and end up in a tight retry loop. Confirmed on the bleeding-edge cluster:

managedclusters.projectcalico.org "<name>" is forbidden:
User "system:serviceaccount:calico-system:calico-manager" cannot
update resource "managedclusters/status" in API group "projectcalico.org"
at the cluster scope

This change:

• Adds managedclusters/status (update) to the calico-manager update role (both ClusterRole and per-tenant Role variants).
• Adds packetcaptures/status (update) to the calico-kube-controllers ClusterRole.

The other resources from https://github.com/tigera/calico-private/pull/11961 (GlobalAlert, GlobalReport, AlertException, SecurityEventWebhook) either already have /status grants or have no current UpdateStatus callers, so they're unchanged here.

Test plan

• Verified live on bleeding-edge mgmt cluster that voltron status writes succeed once the calico-manager role is updated.
• pkg/render + pkg/render/kubecontrollers unit tests pass (rule-count assertions updated).

[caseydavenport]

Linked PRs for EV-6617 / EV-6621:

• calico-private master: #11977 + #11979
• calico-private release-calient-v3.23: #11984
• operator master: Grant /status RBAC for ManagedCluster and PacketCapture #4823
• operator release-v1.42: [release-v1.42] Grant /status RBAC for ManagedCluster and PacketCapture #4824