cloud: Create and use a global Cost Monitor role

At the moment we create a per-namespace Cost Monitor role and use it in the corresponding per-namespace service account, but due to the logic of removing role, where they linger as "deleted" for a while, we get a lot of noise in the list of service accounts and roles. Consider making that role per-project, similarly to the PostgreSQL instance.

Start by locating the logic that creates per-namespace Cost Monitor roles and the corresponding service accounts. Compare it with the per-project PostgreSQL instance pattern; done means a project-level role is created and used without leaving per-namespace roles behind.

Written by the indexing model from the issue text.