Support grant extra permisson for the work agent

[zhujian7]

Describe the enhancement
When we try to use the manifestwork API to manage a resource that the work-agent does not have permission, there will be an error ... is forbidden: User "system:serviceaccount:open-cluster-management-agent:klusterlet-work-sa" cannot get resource ... ,
we can refer to the doc to address this, but it will be good if the clusteradm can also grant permission for the work agent