Review api-catalog-browser ClusterRole: remove internal resource permissions

## Problem

The `api-catalog-browser` ClusterRole currently grants consumers cluster-wide read access to internal platform resources:

```yaml
# View rate limiting plans cluster-wide (to understand available tiers)
- apiGroups: ["extensions.kuadrant.io"]
resources: ["planpolicies"]
verbs: ["get", "list", "watch"]

# View policies cluster-wide (read-only, to understand API requirements)
- apiGroups: ["kuadrant.io"]
resources: ["authpolicies", "ratelimitpolicies"]
verbs: ["get", "list", "watch"]

# View HTTPRoutes and Gateways cluster-wide (to understand API endpoints)
- apiGroups: ["gateway.networking.k8s.io"]
resources: ["httproutes", "gateways"]
verbs: ["get", "list", "watch"]
```

These are internal implementation details that **should not be exposed to external API consumers**:

- `HTTPRoute` and `Gateway` are infrastructure-level objects managed by API owners/admins
- `AuthPolicy`, `RateLimitPolicy`, and `PlanPolicy` are internal Kuadrant resources that consumers have no business directly querying

Granting consumers visibility into these resources violates the principle of least privilege and leaks internal platform topology to external users.

## What Consumers Legitimately Need

API consumers do have a valid need for some derived information — enforced auth policies, rate limit tiers, API endpoints — to make informed decisions about how to consume an API. However, this information should be available **through the `APIProduct` resource**, which is the only resource a consumer should need cluster-wide access to.

The `api-catalog-browser` role should, ideally, only grant:

```yaml
rules:
- apiGroups: ["devportal.kuadrant.io"]
resources: ["apiproducts"]
verbs: ["get", "list", "watch"]
```

## Tasks

- [ ] Define exactly what information consumers need from `HTTPRoute`, `Gateway`, `AuthPolicy`, `RateLimitPolicy`, and `PlanPolicy`, and determine how it should be made available via `APIProduct`
- [ ] Remove `httproutes`, `gateways`, `authpolicies`, `ratelimitpolicies`, and `planpolicies` from `api-catalog-browser` once consumers can get what they need through `APIProduct`
- [ ] Update the console plugin to no longer require consumers to have access to those resources

Locate the api-catalog-browser ClusterRole and the console plugin code that reads HTTPRoutes, Gateways, AuthPolicies, RateLimitPolicies, and PlanPolicies. Trace what consumers need and how APIProduct can provide it before changing permissions. Done means the role exposes only the required APIProduct access and the console plugin no longer depends on the internal resources.

Written by the indexing model from the issue text.