Update role binding

[koikonom]

After changing the way we remove finalizers we also need to update the permissions.

[CLAassistant]

All committers have signed the CLA.

[chrisseto]

These permissions should be added as a marker to the controller that requires them. Running ./task k8s:generate-manifests will revert this change.

[chrisseto]

For posterity: The /finalizers appears to be a valid albeit under documented permission that is not a "true" subresource like status. Certmanager has a reference in their manifests to this page which seems to indicate that /finalizers acts more like a permission for ownerreferences than anything else.

A quick grep of the Kubernetes code base doesn't offer many hints.

[chrisseto]

I'm going to merge this and ignore the failures from k8s-operator. Kuttl tests have been quite flakey as of late and this is a fairly safe change. See also #173