Limit default k8s role's access to collection API

The default `security.json` generated by the operator has full CollectionAPI access, see
https://github.com/apache/solr-operator/blob/84a7781e498a92a66d62eac2a3515c1646bd5ce6/controllers/util/solr_security_util.go#L351

Since the operator typically is using BasicAuth, which is les secure than other auth methods, it could make sense to explicitly limit the `action`s the `k8s` role can do on the collection API, i.e. not allow that BasicAuth user to create or delete collections. This can be done by adding `params` limitation to the custom permission, e.g.

```json
{
"name": "k8s-status",
"role":"k8s",
"collection": null,
"path":"/admin/collections",
"params": {
"action": ["LIST", "CLUSTERSTATUS", "OVERSEERSTATUS", "BACKUP"]
}
}
```

Start in controllers/util/solr_security_util.go at the security.json generation linked in the issue, and inspect the default k8s-status permission for the Collection API. Limit its action parameters to the operations listed in the issue, then verify that the generated permission no longer allows collection creation or deletion.

Written by the indexing model from the issue text.