Refactor workspace manager permissions and role bindings

[abellonioandrea]

Description
This PR refactors workspace manager permissions by aggregating them into a single ClusterRole (crownlabs-workspace-manager), rather than creating multiple separate RoleBindings per namespace.

Changes

• ClusterRoles: Added a new aggregated ClusterRole that collects manager permissions (templates, shared volumes, instance snapshots) via label selector.
• Workspaces: The workspace controller now enforces a single RoleBinding to the new aggregated role and cleans up the old bindings.
• Personal Workspaces: The tenant controller is aligned to use the exact same aggregated RoleBinding for personal workspaces, granting tenants consistent access to resources like shared volumes. Old bindings are automatically migrated and removed.

https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

This PR is related to #1179

[kingmakerbot]

Hi @abellonioandrea. Thanks for your PR.

I am @kingmakerbot.
You can interact with me issuing a slash command in the first line of a comment.
Currently, I understand the following commands:

• /rebase: Rebase this PR onto the master branch
• /merge: Merge this PR into the master branch
• /hold: Adds hold label to prevent merging with /merge
• /unhold: Removes the hold label to allow merging with /merge
• /deploy-staging: Deploy a staging environment to test this PR (the build-all flag enables user environments building)
• /undeploy-staging: Manually undeploy the staging environment

Make sure this PR appears in the CrownLabs changelog, adding one of the following labels:

• kind/breaking: 💥 Breaking Change
• kind/feature: 🚀 New Feature
• kind/bug: 🐛 Bug Fix
• kind/cleanup: 🧹 Code Refactoring
• kind/docs: 📝 Documentation