Grant the dcgm-exporter DRA role read access to ConfigMaps

[rajathagasthya]

Description

DCGM_EXPORTER_CONFIGMAP_DATA set through dcgmExporter.env points the
exporter at a ConfigMap of custom metrics that it reads from the Kubernetes
API. On the GPUCluster path neither the namespaced Role nor the ClusterRole
granted configmaps, so the read failed with a forbidden error and the
exporter fell back to its built-in metrics without crashing. The ClusterPolicy
path has granted this since before the feature existed.

Add configmaps get/list to the namespaced Role. The Role is bound in the
operator namespace only, so a namespace:name value pointing elsewhere is
still denied.

Verified on a DRA cluster: the ServiceAccount can read ConfigMaps and the
custom metric set is served. Golden fixtures updated to match.

Follow-up to #2721, which fixes the equivalent problem on the ClusterPolicy
path.

Checklist

• No secrets, sensitive information, or unrelated changes
• Lint checks passing (make lint)
• Generated assets in-sync (make validate-generated-assets)
• Go mod artifacts in-sync (make validate-modules)
• Test cases are added for new code paths

[tariq1890]

The role in the upstream helm chart is only requesting a get privilege and it is scoped to a particular resource name

- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["exporter-metrics-config-map"]
  verbs: ["get"]

[rajathagasthya]

I'm not sure why the upstream chart is scoping this to a particular resource name. The ConfigMap name is user supplied, so it doesn't make sense to restrict the name.

As for having both get and list permissions, this PR matches what is granted to the ClusterPolicy-based DCGM Exporter role:

gpu-operator/assets/state-dcgm-exporter/0200_role.yaml

Lines 17 to 24 in cfabcc9

	- apiGroups:
	- ""
	resources:
	- configmaps
	- pods
	verbs:
	- get
	- list

We could scope this to only get and only create the role when a ConfigMap is provided, but that would be a deviation from a known ClusterPolicy configuration and would require thorough testing.

[rajathagasthya]

The upstream role is referring to this ConfigMap containing all custom metrics, and is gated behind .Values.customMetrics: https://github.com/NVIDIA/dcgm-exporter/blob/main/deployment/templates/metrics-configmap.yaml. It looks like an example to me.

We also let users create a ConfigMap from the chart, but we don't restrict the name and hence don't scope the role to one resource name.

gpu-operator/deployments/gpu-operator/templates/dcgm_exporter_config.yaml

Lines 1 to 14 in cfabcc9

	{{- if .Values.dcgmExporter.config }}
	{{- if and (.Values.dcgmExporter.config.create) (not (empty .Values.dcgmExporter.config.data)) }}
	apiVersion: v1
	kind: ConfigMap
	metadata:
	name: {{ .Values.dcgmExporter.config.name }}
	namespace: {{ .Release.Namespace }}
	labels:
	{{- include "gpu-operator.labels" . | nindent 4 }}
	data:
	dcgm-metrics.csv: |
	{{- .Values.dcgmExporter.config.data | nindent 4 }}
	{{- end }}
	{{- end }}