fix(helm): grant RBAC for ChainVersionCatalog and PodMonitor

Chart's manager ClusterRole was out of sync with config/rbac/role.yaml —
controller couldn't list/watch chainversioncatalogs (cluster-scoped CRD)
and was failing with forbidden errors after CRD was shipped in 1f17eae.

Context: investigated controller crashloop in chainplane-system, looked
at pod logs showing repeated reflector "forbidden" errors for
chainversioncatalogs and traced the missing rules by diffing the helm
template against generated config/rbac/role.yaml. Took ~15min.

Author: tazhate

charts/chainplane/templates/clusterrole.yaml

@@ -9,6 +9,7 @@ rules:
       - chains.chainplane.io
     resources:
       - chaininstances
+      - chainversioncatalogs
     verbs:
       - create
       - delete
@@ -21,16 +22,30 @@ rules:
       - chains.chainplane.io
     resources:
       - chaininstances/finalizers
+      - chainversioncatalogs/finalizers
     verbs:
       - update
   - apiGroups:
       - chains.chainplane.io
     resources:
       - chaininstances/status
+      - chainversioncatalogs/status
     verbs:
       - get
       - patch
       - update
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - podmonitors
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
   - apiGroups:
       - apps
     resources: