fix: Add /federate nonResourceURLs permission to Prometheus ClusterRole

Adds the /federate endpoint permission to the auto-generated Prometheus
ClusterRole to fix HTTP 403 Forbidden errors when ServiceMonitors attempt
to scrape metrics from the /federate endpoint.

This resolves the issue where CMO federation to hypershift-monitoring-stack
fails on all MC clusters because the ClusterRole was missing the required
nonResourceURLs permission.

Fixes: SREP-3312

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: anispate

pkg/controllers/monitoring/monitoring-stack/components.go

@@ -83,6 +83,9 @@ func newPrometheusClusterRole(ms *stack.MonitoringStack, rbacResourceName string
 			Resources:     []string{"securitycontextconstraints"},
 			ResourceNames: []string{"nonroot", "nonroot-v2"},
 			Verbs:         []string{"use"},
+		}, {
+			NonResourceURLs: []string{"/federate"},
+			Verbs:           []string{"get"},
 		}},
 	}
 }