Minimize required permissions for GitOps in GitLab Kubernetes Agent