fix(psql): isolate controller RBAC

[HaoyL666]

solve: https://jira.oci.oraclecorp.com/browse/OKE-44458

Summary

Moves the PostgreSQL controller off the shared default ServiceAccount and reduces its Secret access to least privilege.

Changes

• Generate a dedicated PSQL manager ServiceAccount.
• Bind the PSQL manager and leader-election roles to that account.
• Remove the PSQL package’s shared/default-ServiceAccount bindings.
• Reduce PSQL Secret RBAC from get,list,watch to get.
• Read credential Secrets through mgr.GetAPIReader() rather than the controller-runtime cache, avoiding the Secret informer
  requirement for list and watch.
• Preserve existing resource ordering for non-dedicated generated packages.
• Add regression coverage proving credential reads bypass the cached client.

Validation

• go test ./pkg/manager ./internal/generator/...
• go build ./...
• go vet ./...
• Rendered PSQL package verification:
  • dedicated ServiceAccount is used
  • no binding to default
  • Secrets permission is get only
• Live OKE test using the pushed PSQL image:
  • image ran with the dedicated ServiceAccount
  • instance-principal authentication succeeded
  • get secrets allowed; list/watch secrets denied
  • Secret-backed DbSystem reconciliation performed a named Secret GET and returned expected NotFound, not RBAC Forbidden