fix(rbac): allow tenant finalizer updates

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Part of #206.

Summary of Changes

• grant the Operator the update verb on the tenants/finalizers subresource
• keep the finalizer permission isolated from normal Tenant resource verbs
• cover both the Helm ClusterRole and the development RBAC manifest with an exact contract test

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed) — N/A; the manifest change is self-contained
• CHANGELOG.md updated under [Unreleased] (if user-visible change) — N/A; this repository does not currently contain CHANGELOG.md
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: additive RBAC repair only; no workload rollout

Update impact

• Helm-managed installations update the ClusterRole in place. No CRD, Tenant, StatefulSet, Pod, Service, or PVC is rewritten or rolled by this PR.
• Reconciles that previously failed while adding or removing the Tenant finalizer can proceed after the RBAC update.
• Installations with rbac.create=false must add update on rustfs.com tenants/finalizers to their externally managed ClusterRole before upgrading the Operator.
• Rollback removes the permission and can reintroduce forbidden finalizer updates; it does not roll Tenant workloads by itself.

Verification

make pre-commit
cargo test --manifest-path e2e/Cargo.toml --test finalizer_rbac_manifest

Additional Notes

This PR is intentionally independent from the security-context and OpenShift delivery changes for #206 and can be reviewed and released separately.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.