Add support to watchNamespace and namespace-scoped rbac for Temporal controller

[R1-lav]

Add support to watchNamespace

Summary

Adds the support to namespace-scoped deployment for the controller manager for environments where cluster wide permissions are not allowed.## Summary

This PR adds support for watching multiple namespaces in the controller via the --watch-namespace flag (or WATCH_NAMESPACE environment variable).

The flag now accepts a comma-separated list of namespaces, allowing the controller to operate in multi-namespace scoped mode.

How it works

• If --watch-namespace (or WATCH_NAMESPACE) is empty, the controller watches all namespaces (default behavior).
• If a single namespace is provided, the controller runs in single-namespace scoped mode.
• If multiple namespaces are provided as a comma-separated list, the controller configures the manager cache to watch only those namespaces.

Example:

--watch-namespace=ns1,ns2,ns3

Other changes

Support of ownNamespace in helm values to support creating roles and rolebinding instead of clusterrole and clusterrolebinding for namespace-scoped deployments

[CLAassistant]

All committers have signed the CLA.