The System Upgrade Controller (SUC) tries to adopt the CRD, requiring
writing permissions, when it can read the CRD. Since we deploy the CRD
anyway, and SUC doesn't need to adopt the CRD. If it can't read CRDs it
just assumes they are all in order, therefore not trying to adopt them.

Therefore this patch removes the permission preventing errors.

This patch fixes the broken garbage collection that is caused by a bug
in the current calico release. This is done by manually upgrading to a
newer patch release of the tigera operator which incorporates a fix.

The garbage collection is currently broken due to a missing permissions
to 'projectcalico.org/v3 Resource=bgpfilters' which results in a stalled
cache sync for the kube-controller-manager garbage collector.

Error logs:
```
graph_builder.go:281] garbage controller monitor not yet synced: projectcalico.org/v3, Resource=bgpfilters
…
garbagecollector.go:250] timed out waiting for dependency graph builder sync during GC sync (attempt 43)
```
References
https://github.com/projectcalico/calico/issues/7715
https://github.com/kubernetes/kubernetes/blob/bb878608686a6276cefec3f51bee5d79b0c8c393/pkg/controller/garbagecollector/garbagecollector.go#L143-L175

This patch downgrades the tigera operator to an older version, since
calico currently shows some weird error. Until further debugged, this is
blocking other updates.

This reverts commit 331561d5.

This patch enables explicit pod security standards on all infrastructure
namespaces.