fix: add ocirepositories to nsaccess rules

[erikgb]

Relates to #3702

What changed?

The primary change in this PR is to add ocirepositories to the source.toolkit.fluxcd.io in the required RBAC rules. This should be part of the requirements alongside the other Flux source types - as weave-gitops is able to list source resources. I did not add any requirement for access to the Flux API groups notification.toolkit.fluxcd.io or image.toolkit.fluxcd.io - even if I think it's strange that this is not a requirement.

I have also organized the required rules better:

• Grouped by API group in list of requirements.
• Fixed the semi-duplicated requirements for events.
• Sorted resources in rules alphabetically.

Why was this change made?

Before starting on the simpler nsaccess checker suggested in #3702 (comment), I would like to correct the code currently used.

How was this change implemented?

How did you validate the change?

Release notes

Documentation Changes