Promote new konflux-admins permissions to prod (#9193)

Update konflux-admins to provide cluster-admin-like permissions while
preventing secret access both directly and indirectly via pod manipulation.

Key changes:
* Block direct access to secrets and internalrequests
* Restrict pod-creating resources (apps, batch, tekton) to read-only+delete
* Expand API group coverage from 30 to 153 groups
* Add konflux-admins-pod-admin for namespace-specific pod management
  (default and openshift-etcd namespaces only)

This prevents users from creating pods that could mount secrets while
maintaining operational capabilities for monitoring and cleanup.

KFLUXINFRA-2410

Signed-off-by: Hugo Ares <[email protected]>

Author: hugares