fix(operator): remove tenant workload RBAC

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Fixes rustfs/backlog#1080

Summary of Changes

• Stop creating Tenant workload Roles and RoleBindings.
• Remove only legacy RBAC that has strict operator provenance, using UID/resourceVersion delete preconditions.
• Watch exact legacy RBAC names so mixed-version rolling upgrades converge after older replicas recreate them.
• Disable automatic API token mounting for operator-managed ServiceAccounts and StatefulSets, and roll default-ServiceAccount workloads once.
• Preserve custom ServiceAccounts and document the least-privilege migration path and downgrade behavior.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased] (N/A: this repository does not contain CHANGELOG.md)
• CI/CD passed (pending)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: Existing default-ServiceAccount Tenants roll once. Workloads that need Kubernetes API access must use a user-managed ServiceAccount with explicit token projection and least-privilege RBAC.

Verification

make pre-commit
cargo test legacy_rbac
cargo test controller_watch_tests
cargo test custom_service_account_releases_security_field_ownership_once

Additional Notes

• createServiceAccountRbac remains parse-compatible but is ignored.
• Direct downgrade can restore the legacy broad permissions; roll forward instead.
• A live Kubernetes mixed-version rolling-upgrade test was not run locally.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.

[GatewayJ]

@codex