fix: restore missing batch/jobs permissions and add PVC permissions to executor role

    - Re-add batch/jobs create/delete permissions that were accidentally removed
    - Add persistentvolumeclaims create/delete permissions for job workspaces
    - Right-size pod permissions to get/list/watch only
    - Fixes customer-reported "cannot create resource persistentvolumeclaims" errors
    - Resolves batch changes functionality breaking due to missing permissions

Author: enriquegh

charts/sourcegraph-executor/k8s/templates/executor.Role.yaml

@@ -9,17 +9,29 @@ metadata:
     sourcegraph-resource-requires: cluster-admin
     app.kubernetes.io/component: executor
 rules:
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - create
+      - delete
   - apiGroups:
       - ""
     resources:
       - pods
       - pods/log
-      - secrets
-      - persistentvolumeclaims
     verbs:
       - get
       - list
       - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+      - persistentvolumeclaims
+    verbs:
+      - get
       - create
       - delete
 {{- end }}