Refine kyverno controllers roles

Summary

Kyverno used to define some default roles for controllers that have been removed in 1.13.1: https://github.com/kyverno/kyverno/pull/11420

To avoid delaying the integration of that new version, we've blindly re-addeed these rules in !3220 (merged) (in coreClusterRole definition to distinguish them from other managed rules): dc9b1d3e

They deserve to be refined to avoid adding useless permissions and moved to clusterRole as other managed rules.