Add permission for RestrictedEndpointsAdmission
Add permission for RestrictedEndpointsAdmission

When RestrictedEndpointsAdmission is enabled, service endpoints are
not allowed to create from other namespace.
Since knative service's endpoints are same with `activator-service`'s
endpoints, it fails to create endpoints if cluster enabled
`RestrictedEndpointsAdmission`.

This patch adds permission `endpoints/restricted` into clusterrole for
address the problem.

knative/serving-operator,knative/serving-operator