Restricting the RBAC rules on secrets

What would you like added?

A possibility to restrict the permission to read the secrets from the cluster-wide, to a namespace-scoped role

Why is this needed?

Working on a shared cluster in a corporate environment is very common. It is about reducing the cost of ownership and maintenance. As it stands the ARC controller grants itself a very generous permissions - including the possibility to see all the secrets from all the namespaces on the entire cluster.
This is very excessive and unnecessary. Any respectful security analyst and/or SRE would reject the request of installing such workload on a shared cluster.

Additional context

Here is a short recipe on how to test this access:

helm repo add actions-runner-controller https://actions-runner-controller.github.io/actions-runner-controller
helm repo update
helm upgrade --install --namespace actions-runner-system --create-namespace\
  --set=authSecret.create=true\
  --set=authSecret.github_token="ghp_XXX"\
  --wait actions-runner-controller actions-runner-controller/actions-runner-controller

kubectl auth can-i get secret -n kube-system --as=system:serviceaccount:actions-runner-system:actions-runner-controller
yes

Start with the Helm installation recipe and its RBAC behavior, then run the kubectl auth can-i check shown in the issue for kube-system. Trace how the actions-runner-system service account receives permission to read secrets; done means the controller retains required access in its namespace while the cross-namespace check no longer returns yes.