fix: keep cscli RBAC when online API is disabled

[julien-redel]

Description

What

Render the configmap-updater Role and RoleBinding whenever the LAPI cscli
credentials are stored in a Secret, even when the online API is disabled.

Fixes #319.

Why

The lapi-cscli-register-job is rendered whenever cscli credentials are stored
in a Secret (StoreLAPICscliCredentialsInSecret), independently of the online
API setting. It runs under the *-configmap-updater-sa ServiceAccount and needs
get/create permissions on the credentials Secret.

However, #347 gated the Role/RoleBinding behind not IsOnlineAPIDisabled. As a
result, with:

lapi:
  env:
    - name: DISABLE_ONLINE_API
      value: "true"

the register job is still created but its ServiceAccount has no permissions, so
the job fails:

error: failed to create secret secrets "<release>-lapi-cscli-credentials" already exists

(the secret-existence guard kubectl get secret ... is silently denied by RBAC,
so the job falls through to kubectl create secret and fails).

How

role.yaml and rolebinding.yaml now render when the online API is enabled
OR when cscli credentials are stored in a Secret:

{{- if or (not (eq (include "IsOnlineAPIDisabled" .) "true")) (eq (include "StoreLAPICscliCredentialsInSecret" .) "true") }}

The inner if or (StoreCAPI...) (StoreLAPICscli...) condition is unchanged, so
the CAPI register job behavior introduced by #347 is preserved (no CAPI RBAC when
the online API is disabled).

Testing

helm template against ci/crowdsec-values.yaml:

Scenario	Expected	Result
DISABLE_ONLINE_API=true + cscli secret	Role + RoleBinding + cscli job rendered	✅
online API enabled + cscli secret	RBAC + cscli job rendered (no regression)	✅
online API disabled + creds not in secret	no RBAC	✅

helm lint ./charts/crowdsec -f ./charts/crowdsec/ci/crowdsec-values.yaml: passes.

Chart version bumped 0.24.0 → 0.24.1.

[github-actions]

@julien-redel: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

• /kind feature
• /kind enhancement
• /kind fix
• /kind chore
• /kind dependencies

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the forked project rr404/oss-governance-bot repository.

[github-actions]

@julien-redel: There are no area labels on this PR. You can add as many areas as you see fit.

• /area agent
• /area local-api
• /area cscli
• /area security
• /area configuration

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the forked project rr404/oss-governance-bot repository.

[julien-redel]

/kind fix
/area cscli
/area local-api