Add support for giving kubernetes mode scaleset service account additional permissions

[marcusramberg]

This is useful for instance to allow buildx kubernetes driver to work, of if you use a custom container hook that needs additional permissions like pod watch.

Tested locally with ct against a kind cluster.

[Copilot]

Pull Request Overview

This PR adds support for extending the Kubernetes mode service account role with additional permissions. This enables scenarios like using buildx Kubernetes driver or custom container hooks that require extra permissions such as pod watch capabilities.

• Adds a new configuration field kubernetesModeAdditionalRoleRules to allow users to specify custom RBAC rules
• Extends the Role template to merge custom rules with default permissions
• Includes test configuration demonstrating deployment management permissions

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
charts/gha-runner-scale-set/values.yaml	Documents the new kubernetesModeAdditionalRoleRules configuration option
charts/gha-runner-scale-set/tests/values_k8s_extra_role_rules.yaml	Provides test case with example deployment permissions
charts/gha-runner-scale-set/templates/kube_mode_role.yaml	Implements the template logic to append additional role rules

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}