Lets the autoapply SA manage cluster-scoped resources too, not just
those in the ci namespace.

Tack's fallback autoapply-yaml pipeline runs as system:serviceaccount:ci:default
before xeiaso-net-alrest-autoapply exists on the cluster, so the initial apply
can't create its own SA/Role/RoleBinding. Adding default as a second subject
breaks the chicken-and-egg.

Signed-off-by: Xe Iaso <me@xeiaso.net>