Sample RBAC for Kubernetes job runner mode

While working on the `dind.enabled` / `service.enabled` PR and my custom queuer.

I ended up writing a custom RBAC configuration to restrict the capability of Pulsar through the SA.

The RBAC covers my specific use case and is not meant to be exhaustive, but it could be useful as a reference for others running Pulsar without DinD on hardened clusters.

**Question:** would it make sense to include it in the chart as a sample (e.g. under `examples/`) with a clear disclaimer that it is not production-ready for every deployment and should be adapted ?

Or include it within the Chart ?

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "pulsar.fullname" . }}-k8s-manager
namespace: {{ .Release.Namespace }}
labels:
{{- include "pulsar.labels" . | nindent 4 }}
rules:
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["create", "get", "list", "watch", "delete"]
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "pulsar.fullname" . }}-k8s-manager
namespace: {{ .Release.Namespace }}
labels:
{{- include "pulsar.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ include "pulsar.fullname" . }}-k8s-manager
subjects:
- kind: ServiceAccount
name: {{ include "pulsar.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
---
```

Review the Helm chart layout and any existing examples before deciding whether this RBAC sample belongs under examples/ or in the chart. Use the supplied Role and RoleBinding as the reference, retain the disclaimer about adapting it, and finish when the sample is included in the chosen location and its templating renders correctly.

Written by the indexing model from the issue text.