Should not have cluster-wide RBAC granting read access to secrets

[erikgb]

Problem

The Helm chart unconditionally grants needed (AFAIK) cluster-wide read access to secrets, and should be replaced with namespaced RBAC:

https://github.com/weaveworks/weave-gitops/blob/main/charts/gitops-server/templates/role.yaml#L18-L28

Would prevent read access cluster-wide.

Solution

Create a new Role in the namespace running ww-gitops with the secret read permissions and a role binding granting the new role to the ww-gitops SA. Remove access to secrets from the cluster role.

Additional context

[erikgb]

It is now possible to opt-out from cluster-wide read access to secrets: #4659.

We will eventually switch the default and clean up the RBAC if this "feature gate" doesn't reveal any issues.