Add rbac for patch operator

The patch operator requires cluster-scoped permissions [1], but it
looks for service accounts per-namespace (yuck). For each namespace in
which we're deploying patches we'll need to add an additional
serviceaccount to the clusterrolebinding, and for each new resource
type we're patching we'll need to update the clusterrole.

[1]: redhat-cop/patch-operator#4

cluster-scope/base/rbac.authorization.k8s.io/clusterrolebindings/patch-operator/clusterrolebinding.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: patch-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: patch-operator
+subjects: []

cluster-scope/base/rbac.authorization.k8s.io/clusterrolebindings/patch-operator/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+    - clusterrolebinding.yaml

cluster-scope/base/rbac.authorization.k8s.io/clusterroles/patch-operator/clusterrole.yaml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: patch-operator
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+      - configmaps
+    verbs:
+      - update
+      - patch
+      - get
+      - watch
+      - list

cluster-scope/base/rbac.authorization.k8s.io/clusterroles/patch-operator/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+    - clusterrole.yaml

cluster-scope/bundles/patch-operator/kustomization.yaml

@@ -4,3 +4,5 @@ resources:
 - ../../base/core/namespaces/patch-operator
 - ../../base/operators.coreos.com/operatorgroups/patch-operator
 - ../../base/operators.coreos.com/subscriptions/patch-operator
+- ../../base/rbac.authorization.k8s.io/clusterrolebindings/patch-operator
+- ../../base/rbac.authorization.k8s.io/clusterroles/patch-operator