Add ServiceAccount and ClusterRoleBinding for the controller manager

The manager-role ClusterRole was defined but never bound, so a deployed
controller using serviceAccountName: controller-manager could not list
or watch IgnitionConfigs and logged continuous "forbidden" errors.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>