Use unprivileged client (bound to the controllers role) when wiring webhooks/controllers in integration tests

[danail-branekov]

Currently we are wiring webhooks/controllers in integration tests to use a k8s client created out of the default env test config. That config describes a user that is part of the cluster admin groups, therefore controllers in the env test run as admin user. This is however not the case on productive deployments - there controllers/webhooks are run as part of the controller deployment as the controllers manager service account which is bound to the controller manager role.

This difference hides potential bugs with permissions misconfiguration. In order to address that, we need to wire controllers and webhooks in all integration test suites with clients with controller manager permissions. We have already done that here, we need to spread the pattern in all envtests.