[BUG] Build Controller Has Permission to Modify CRDs

[adambkaplan]

Is there an existing issue for this?

• I have searched the existing issues

Kubernetes Version

Kubernetes 1.30.0

Shipwright Version

v0.14.0

Current Behavior

In #1646, the build controller was granted permission to patch CustomResourceDefinitions. This presents a minor security risk due to the controller having excessive permissions (violates principle of least privilege).

Admins using the version migrator should create a dedicated service account and RBAC for this purpose.

Expected Behavior

The build controller should not have permission to modify CRDs.

Steps To Reproduce

1. Install Shipwright Builds v0.14.0.
2. Inspect the RBAC granted to the build controller's service account.

Anything else?

No response