bug(apps): dashboard resource Roles grant list and watch under resourceNames, which never matches #3613

Every packages/apps/*/templates/dashboard-resourcemap.yaml, 18 files, emits a Role named {{ .Release.Name }}-dashboard-resources whose rules pair resourceNames with verbs: ["get", "list", "watch"]. See packages/apps/bucket/templates/dashboard-resourcemap.yaml:9-14 for the secrets rule. A list or watch request carries no resource name, so the authorizer cannot match it against a rule that has resourceNames set, and only the get in those verb lists is ever effective.

A subject holding only this Role can fetch each object by name but gets a 403 on any collection request, so anything that enumerates rather than fetches comes back empty or errors.

The fix is to split each rule in two, keeping resourceNames with get and adding a separate name-less rule for list and watch scoped by resource type, accepting that list and watch are then namespace-wide for that type since that is the only granularity RBAC offers. Doing it in one sweep across all 18 charts keeps them consistent.