fix: support AWS RDS by reading pg_roles instead of pg_authid

On AWS RDS, SELECT on pg_authid is denied to all roles (including the
master user and rds_superuser), so every Role reconcile failed with
"permission denied for table pg_authid" (SQLSTATE 42501). The same
applies to any non-superuser role on vanilla PostgreSQL.

- RoleService reads role state from the world-readable pg_roles view
  (roleExists, roleLoginMatches, fetchCurrentFlags); pg_roles added to
  jOOQ codegen and regenerated.
- PostgreSQLAuthenticationService.checkPassword returns
  MATCH/MISMATCH/UNVERIFIABLE, returning UNVERIFIABLE on SQLSTATE 42501
  instead of throwing.
- On UNVERIFIABLE (RDS), the reconciler detects password changes by
  comparing the password Secret's resourceVersion against
  Role.status.appliedPasswordSecretVersion, so no password-derived
  material is stored in etcd. KubernetesService.getSecretRefData returns
  credentials and the Secret resourceVersion together.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: wessel

generated/build.gradle.kts

@@ -39,6 +39,7 @@ jooq {
                 | pg_default_acl
                 | pg_get_userbyid
                 | pg_namespace
+                | pg_roles
                 | shobj_description
                 """.trimIndent()
                 excludes = """