Create minimal RBAC for update

[durera]

Feature and motivation

We have now provided a minimal RBAC for a core platform only MAS install, we need to provide minimal RBAC supporting MAS update as well.

Usage example

Many customers do not wish to run update under the cluster-admin ClusterRole.