Add user RBAC to default config

[glrf]

Summary

With this PR for the local environment we

• Allow any authenticated user to view Zones and create organizations as well es manage created organizations
• Switch to preferred_username claim from the email

Checklist

• PR contains a single logical change (to build a better changelog).
• Categorize the PR by setting a good title and adding one of the labels:
  bug, enhancement, documentation, change, breaking, dependency
  as they show up in the changelog.

[ccremer]

we can generate the roles via kubebuilder?
e.g. https://github.com/k8up-io/k8up/blob/7e06b6cdc987c76a5c39755a8b831947869a2ca4/controllers/schedule_controller.go#L28
and maybe even consolidate to default view role? https://github.com/k8up-io/k8up/blob/7e06b6cdc987c76a5c39755a8b831947869a2ca4/config/rbac/consolidated_viewer_role.yaml#L8

[glrf]

Aggregating to view might be a good idea. I'll try that!

I personally wouldn't use kubebuilder for that as it's not a role for the controller.

[glrf]

Wait no. We don't actually want to give users the view role 😅 They shouldn't be able to see other resources such as namespaces or pods

[ccremer]

ah, right :)