feat(lib): add RoleRef support

[maximiliantech]

What this PR does / why we need it:
This PR adds support for adding RoleRefs to the MCP and Workload cluster.

Which issue(s) this PR fixes:
Related openmcp-project/service-provider-crossplane#21

Special notes for your reviewer:
NONE

Release note:

Adding support in the lib to reference RoleRefs in the ClusterAccess reconciler.

[Diaphteiros]

Looks good to me.

Regarding the role ref feature for workload clusters:
We can add this for the sake of uniformity, but I hope that we never actually have to use it. Since the workload clusters are shared between multiple tenants, we should be very careful with permissions there and binding to pre-exisiting (cluster)roles sounds dangerous.

[reshnm]

Looks good to me.

Regarding the role ref feature for workload clusters: We can add this for the sake of uniformity, but I hope that we never actually have to use it. Since the workload clusters are shared between multiple tenants, we should be very careful with permissions there and binding to pre-exisiting (cluster)roles sounds dangerous.

I would assume and hope, that these access requests are only being used during deployment and NOT during runtime.
The originating problem was that Flux/Crossplane need to create aggregation RBAC resources which is only allowed by cluster-admin. The cluster-admin should be dropped when running these controllers since they are using their own service accounts.