move tigera-prometheus secret RBAC from Clusterrole to Role

[vara2504]

Moving the secret RBAC for tigera-prometheus from a ClusterRole to a Role within the tigera-prometheus namespace, restricting the scope to allow the creation of secrets only in the tigera-prometheus namespace.

Description

For PR author

• [ ] Tests for change.
• [ ] If changing pkg/apis/, run make gen-files
• [ ] If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• [ ] Milestone set according to targeted release.
• [ ] Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.