Improve SAR checks for Kubernetes components to make it easier to use CRs in DevWorkspaces

[amisevsk]

Description

When a DevWorkspace with Kubernetes/OpenShift components is created or edited, the DevWorkspace Operator performs SAR checks to verify that both the user editing the DevWorkspace and the controller service account can operate on the inlined component. For the controller's service account, the webhook server checks if the SA has "*" permissions for the object.

This is not a problem for usual components (pods, services, etc.) but makes specifying CRs inlined within DevWorkspaces difficult, as "*" is checked literally rather than "all verbs", so even if the DWO serviceaccount can create/update/delete/etc. the resource, it still fails this check.

We should investigate whether this can be improved, to make using CRs in DevWorkspaces work without additional configuration.

Additional context