add explicit permissions for ESO resources

[SgtCoDFish]

I was seeing issues in e2e tests in a separate PR with permissions for ESO resources. I'd thought that the way ESO was configured with the viewer role would mean the permissions were fine, but maybe it's best to be explicit anyway.

This was caught in a copilot review on #780 but I really thought it wouldn't be a problem.

[wallrj-cyberark]

Looks good.

I can see the watcher / lister starting up successfully, in the E2E test logs:

• https://github.com/jetstack/jetstack-secure/actions/runs/22357311138/job/64702165844?pr=781#step:7:892

{
  "ts": 1771946690636.7156,
  "caller": "transport/round_trippers.go:632",
  "msg": "Response",
  "v": 6,
  "verb": "GET",
  "url": "[https://10.96.0.1:443/apis/external-secrets.io/v1/secretstores?limit=500&resourceVersion=0](https://10.96.0.1/apis/external-secrets.io/v1/secretstores?limit=500&resourceVersion=0)",
  "status": "200 OK",
  "milliseconds": 4
}

In comparison to the previous PR, where the logs show the request is forbidden:

• https://github.com/jetstack/jetstack-secure/actions/runs/22309879666/job/64538740067#step:7:1120

{
  "ts": 1771856354155.9285,
  "caller": "transport/round_trippers.go:632",
  "msg": "Response",
  "v": 6,
  "verb": "GET",
  "url": "[https://10.96.0.1:443/apis/external-secrets.io/v1/clusterexternalsecrets?limit=500&resourceVersion=0](https://10.96.0.1/apis/external-secrets.io/v1/clusterexternalsecrets?limit=500&resourceVersion=0)",
  "status": "403 Forbidden",
  "milliseconds": 2
}
{
  "ts": 1771856354155.96,
  "caller": "transport/round_trippers.go:632",
  "msg": "Response",
  "v": 6,
  "verb": "GET",
  "url": "[https://10.96.0.1:443/apis/external-secrets.io/v1/secretstores?limit=500&resourceVersion=0](https://10.96.0.1/apis/external-secrets.io/v1/secretstores?limit=500&resourceVersion=0)",
  "status": "200 OK",
  "milliseconds": 2
}