Drift on jenkins_edit rolebinding in local cluster

In #566, we changed the jenkins_edit rolebinding to a non-cluster role. Since then, in actual clusters, there is no drift anymore. However, a local cluster (oc cluster up) shows:

--- Current State (OpenShift cluster)
+++ Desired State (Processed template)
@@ -1,4 +1,4 @@
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: authorization.openshift.io/v1
    kind: RoleBinding
    metadata:
    annotations: {}
@@ -6,8 +6,6 @@
        template: ods-jenkins-template
    name: jenkins_edit
    roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
    name: edit
    subjects:
    - kind: ServiceAccount

If we delete the rolebinding in an actual cluster, and create it using the "suggested" values from above, we get a different ("opposite") diff:

--- Current State (OpenShift cluster)
+++ Desired State (Processed template)
@@ -1,4 +1,4 @@
-apiVersion: authorization.openshift.io/v1
+apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   annotations: {}
@@ -6,6 +6,8 @@
     template: ods-jenkins-template
   name: jenkins_edit
 roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
   name: edit
 subjects:
 - kind: ServiceAccount

I am not sure what causes the difference. I think #566 wrongly assumed that edit is not a cluster role. It should be - as there is no project-local edit role. But if that is the case, why does it then always trim apiGroup and kind from the created resource?

The goal would be to find one spec that works in both cases.

FYI @clemensutschig @gerardcl @georgfedermann If you have any additional pointers, let me know.