Allow creating `ClusterRole` aggregations

[brookelew]

Create user-facing roles with the

rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-view: "true"

authorizations, similar to what cert-manager has.

/kind feature