Allow namespaces readonly crd-controller rbac

Readonly access to namespaces is needed by the
image-reflector-controller to support the cross-namespace accessFrom
functionality introduced in image-reflector-controller#162.

Signed-off-by: Aurel Canciu <aurelcanciu@gmail.com>