Fix default organization controller RBAC

[simu]

Summary

Without this RBAC configuration, the default organization controller isn't allowed to modify arbitrary users, cf. the user webhook implementation:

control-api/webhooks/user_webhook.go

Lines 32 to 46 in 9fb0488

	// Allow the user to create or update itself.
	// A special permission, used for controllers, `create rbac.appuio.io users` can override this.
	if req.AdmissionRequest.Operation == admissionv1.Create && req.UserInfo.Username != req.Name {
	if err := sar.AuthorizeResource(ctx, v.client, req.UserInfo, sar.ResourceAttributes{
	Verb: "create",
	Group: "rbac.appuio.io",
	Resource: req.Resource.Resource,
	Version: req.Resource.Version,
	Name: req.Name,
	}); err != nil {
	log.Info("User not authorized to create other users", "request_user", req.AdmissionRequest.UserInfo, "user", req.Name, "error", err)
	return admission.Denied(fmt.Sprintf("user %q is not allowed to create or update %q", req.UserInfo.Username, req.Name))
	}
	log.Info("User authorized to create other users", "user", req.AdmissionRequest.UserInfo)
	}

Checklist

• PR contains a single logical change (to build a better changelog).
• Categorize the PR by setting a good title and adding one of the labels:
  bug, enhancement, documentation, change, breaking, dependency
  as they show up in the changelog.