update permission for tidb-controller-manager and add example for tidb-monitor (#1954)

[sre-bot]

cherry-pick #1954 to release-1.1

---

What problem does this PR solve?

1. After upgrade TiDB Operator from v1.0 to v1.1, then create TiDB Monitor CR, tidb-controller-manager reports below error:

Event(v1.ObjectReference{Kind:"TidbMonitor", Namespace:"dan10", Name:"dan10", UID:"c8b9b9ed-67f9-11ea-8886-8a678ff421f7", APIVersion:"pingcap.com/v1alpha1", ResourceVersion:"68470646", FieldPath:""}): type: 'Warning' reason: 'FailedSync' Sync TidbMonitor[dan10/dan10] Deployment failed,err:secrets "dan10-monitor" is forbidden: User "system:serviceaccount:tidb-admin:tidb-controller-manager" cannot update resource "secrets" in API group "" in the namespace "dan10"

2. No full example for TiDB Monitor.

What is changed and how does it work?

update permission for tidb-controller-manager and add example for tidb-monitor

Check List

Tests

• Manual test (add detailed scripts or steps below)
  TiDB Monitor CR can be created and synced.

Related changes

• Need to cherry-pick to the release branch

Does this PR introduce a user-facing change?:

NONE

Other issues during test of TiDB Monitor are recorded in #1949.

[aylei]

LGTM