Basic Requirements

A new field should be added on the GlobalRole type called NamespacedRules.
This field should be a map[string][]rbacv1.PolicyRule, indicating which rules are active in which namespaces.
The use of * should have no special meaning as a key.
Each value in the map should result in one role in the namespace specified by key
When a GlobalRoleBinding is made to a global role using these fields, one rolebinding should be made (per namespace) to the role created in the handler
The role/rolebinding should have labels indicating which GlobalRole/GlobalRoleBinding they are owned by
The role/rolebinding should have an ownerRef referring to the GlobalRole/GlobalRoleBinding
If the role/rolebinding is updated/deleted, it should enqueue the owning GlobalRole/GlobalRoleBinding (as defined by the label)
The GlobalRole/GlobalRoleBinding controllers should remove any roles/bindings which claim to be owned by the GlobalRole/GlobalRoleBinding (by label) but are for a different subject or have different rules.
Tests should be written for all net-new code

[RFE] Add new "NamespacedRules" field. #42215