fix: grant secret read permission to graylog-secret-patch service account

- Add RBAC rule to allow reading graylog-opensearch-admin-password secret
- Patch job needs this to URL-encode password for GRAYLOG_ELASTICSEARCH_HOSTS
- Without this permission, password is empty causing authentication failures
- Restricts access to only the required secret for security

Author: surrealwolf

graylog/overlays/nprd-apps/graylog-secret-patch-job.yaml

@@ -271,6 +271,10 @@ rules:
 - apiGroups: ["apps"]
   resources: ["statefulsets"]
   verbs: ["get", "patch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames: ["graylog-opensearch-admin-password"]  # Only allow reading this specific secret
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding