chore: Describe RBAC rules, remove unnecessary rules

[NickLarsenNZ]

Part of stackabletech/issues#798

Note

This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.

• Document each rule
• Check the docs make sense. Rewrite where necessary
• Remove unnecessary permissions
• Attach explanations to PR description
• Run all tests
• Split operator and product roles into separate files

Explanation

Resource	Verbs removed	Reason
pods	entire rule	StatefulSets create pods; the operator never manages Pod objects directly, and pods are not in delete_orphaned_resources
endpoints	entire rule	Auto-created by Kubernetes for Services; never managed directly by the operator
listeners.stackable.tech/listeners	entire rule (get)	No client.get::<Listener>() call exists in the codebase; listener PVCs are embedded in StatefulSet volume claim templates -- the ListenerOperatorVolumeSourceBuilder is a pure struct builder making no API calls
update (all resources)	verb removed everywhere	SSA uses PATCH (create + patch); there are no client.update() / api.replace() calls anywhere in the operator
watch on serviceaccounts	verb removed	ServiceAccounts are not watched via .owns() or .watches() in main.rs
watch on rolebindings	verb removed	Same reason
watch on poddisruptionbudgets	verb removed	Same reason
patch on hbaseclusters	verb removed	The operator only writes hbaseclusters/status (via apply_patch_status()), covered by the separate /status subresource rule