feat(observability): grant TA CRD watch RBAC under scraping gate

The Target Allocator watches the ServiceMonitor/PodMonitor CRDs to start/stop
informers as CRDs appear or disappear. Under the otelContainerInsights scraping
path the TA ClusterRole granted list/watch on the monitors but not on
customresourcedefinitions, so the operator-side CRD watch was denied, the CRD
gate never opened, and SM/PM discovery failed quietly. Add the read-only
get/list/watch grant on customresourcedefinitions beside the monitoring.coreos.com
rule under the same $otelCIScrape gate. Comment-only render change; gated off by
default.

Author: wenegiemepraise

charts/amazon-cloudwatch-observability/templates/target-allocator-clusterrole.yaml

@@ -27,6 +27,10 @@ rules:
   - apiGroups: [ "monitoring.coreos.com"]
     resources: ["podmonitors", "servicemonitors"]
     verbs: ["get", "list", "watch"]
+  # TA watches the SM/PM CRDs to start/stop informers as they appear or disappear (read-only).
+  - apiGroups: [ "apiextensions.k8s.io" ]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
   {{- end }}
 {{- end }}
 ---