Security: `system:authenticated` group bound to controller ClusterRole grants all authenticated users cluster-wide write access to Tekton resources

[sestegra]

The manual-approval-gate-controller-cluster-access ClusterRoleBinding includes system:authenticated as a subject, which grants every authenticated cluster user the same permissions as the controller, including write access to Tekton Runs resources (see [manual-approval-gate-controller-cluster-access]](https://github.com/openshift-pipelines/manual-approval-gate/blob/v0.8.0/config/kubernetes/201-clusterrole.yaml#L15) ClusterRole).

Only the manual-approval-gate-controller ServiceAccount should be bound to this ClusterRole.