[Security hardening] Replace default cluster-admin binding with least-privilege RBAC

Summary

The VN2 Helm chart grants the VN2 infrastructure ServiceAccount the built-in
cluster-admin ClusterRole by default.

Although rbac.roleRef is configurable, the chart does not provide a dedicated
least-privilege ClusterRole for the core VN2 components.

Affected version

• Chart: virtualnode-1.3410.26082101
• Commit: 459ee5601f2bc730844b17063808076f42c80bb2

Evidence

Helm/virtualnode/values.yaml:

rbac:
  install: true
  serviceAccountName: virtual-node2-helm
  roleRef: cluster-admin


## Security impact

Compromise of a VN2 component using this ServiceAccount could provide full

administrative control of the Kubernetes cluster, including access to secrets,

workloads, and RBAC configuration.

## Expected behavior

The chart should create and bind a dedicated ClusterRole containing only the

permissions required by VN2. A default installation must not reference the

built-in `cluster-admin` role.

Start with Helm/virtualnode/values.yaml and trace the chart's current RBAC configuration and binding. Identify the permissions required by the VN2 components, define a dedicated least-privilege ClusterRole, and verify that a default installation no longer references the built-in cluster-admin role.