feat: Reduce permissions for system-upgrade-controller serviceaccount

This patch drastically cuts down the permissions of the
system-upgrades-controller from the previous cluster-admin permissions
to a tailored set of permissions for the controller.