What this PR does / why we need it:

When a FeatureStore selects the Ray compute engine in KubeRay mode (type: ray.engine, use_kuberay: true), the Feast pod uses the CodeFlare SDK to discover a RayCluster and read mTLS Secrets. Previously the Feast service account had no permissions on ray.io/rayclusters or core/secrets, so every materialization failed with 403 Forbidden and users had to hand-apply a Role + RoleBinding before each deployment.

This PR makes the operator provision that RBAC automatically:

• New internal/controller/services/ray_rbac.go detects KubeRay mode from the batch-engine ConfigMap and CreateOrUpdates a namespace-scoped Role + RoleBinding named feast-<crName>-kuberay, owner-referenced to the FeatureStore for automatic GC. When use_kuberay flips back to false (or batchEngine is removed) the resources are deleted on the next reconcile.
• Role rules match exactly what CodeFlare needs:
  • ray.io/rayclusters → get, list, watch
  • core/secrets → get, list, watch, create, update, delete
• Wired into FeastServices.Deploy() right after createServiceAccount() so the binding subject exists before the Role applies.
• Operator's own kubebuilder RBAC markers widened to match — Kubernetes RBAC escalation rules require the granter to hold the verbs it grants. config/rbac/role.yaml and dist/install.yaml regenerated via make manifests / make build-installer.
• No CRD changes. use_kuberay: true already exists in the Ray compute engine config; the operator just learns to act on it.
• Docs updated in docs/how-to-guides/feast-operator/06-batch-and-jobs.md so users know manual RBAC setup is no longer required.

Which issue(s) this PR fixes:

Fixes #6408

Checks

• I've made sure the tests are passing.
• My commits are signed off (git commit -s)
• My PR title follows conventional commits format

Testing Strategy

• Unit tests
• Integration tests
• Manual tests
• Testing is not required for this change

Misc

New ginkgo suite at internal/controller/featurestore_controller_kuberay_rbac_test.go covers three reconciler-level flows against an envtest API server:

• Role + RoleBinding are created with the correct rules and owner reference when the batch-engine ConfigMap has type: ray.engine and use_kuberay: true.
• Both are deleted on the next reconcile when use_kuberay flips to false.
• Neither is created when no batchEngine is configured.

The operator's full suite (make fmt vet lint test) passes locally with these changes.