Retain the get/list/watch for calico-kube-controller SA

[vara2504]

The Federated Services Controller needs access to the remote kubeconfig secret in order to create a remote syncer. To support the existing configuration, where the user may have already created this service token (secret) in the kube-system or their own namespace, reverting the get, list, and watch operations to the cluster scope.

https://tigera.atlassian.net/browse/EV-5480

Description

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[rene-dekker]

lgtm