[DOCS#EV-6436]: Document the RBAC management UI for Calico Enterprise - #3035

…n notes for the RBAC management UI

The console has no form for the LDAP directory connection in this release,
so the section now leads with creating tigera-idp-ldap-config and explains
the URL and host requirement after the example. Drop the note about the bind
password not being shown again, which only applied to the API, and the
remark that the console cannot turn role management off.

Replace the curl to /ui-apis/team/export?target= with the edits it makes:
in the bindings labeled rbac.tigera.io/managed-cluster, the source cluster's
name appears in the label, the annotation, the end of metadata.name and the
end of roleRef.name. Changing those four values to the target cluster gives
the same file the API would return. Every other binding in the export does
not name a cluster and applies unchanged.

Fixes found by checking each statement against ui-apis, rbacsync, the
operator and ui-modules:

- Tier has no default; all tiers has to be chosen.
- The permission is Modify Alerts and Security Events Settings, and its
  notes show in the expanded role, not in the picker. View also reads the
  security events.
- Not every permission comes as View and Modify; list the one-variant ones.
- A managed cluster's roles also need role management on the management
  cluster.
- Turning role management off freezes roles: all tiers stops following new
  tiers and directory removals stop revoking.
- Exports copy between standalone and management clusters, or between
  managed clusters. A missing tier is rejected for tigera-network-admin.
- Drop the audit command, which missed RoleBindings and listed hidden
  bindings.
- Name the Authentication settings an IdP role depends on: groupSearch, a
  matching nameAttribute, and no groupsPrefix. Manual role names must match
  the token's group, prefix included.
- Renaming a manual role changes only its display name.
- Directory removals revoke roles, and tigera-network-admin cannot change the
  directory secret after creating it.
- Create the directory secret from a manifest, keeping the password off the
  command line.
- Drop the minimum version line.

Link the page from the identity provider page.

The directory sync runs in calico-kube-controllers, not the web console, so
say "Calico Enterprise can connect only to that host". An in-cluster
directory is reachable only when Authentication.spec.ldap.host names it as
<service>.<namespace>.svc, so say that too.

- Drop "Nothing else decides who holds a role."
- The directory secret goes on the standalone or management cluster.
- Policy permissions also grant flow logs; Dashboards and Service Graph
  grant the logs their pages show.
- Say the console has no off switch, and list jq as a requirement.
- Tier is required for policy permissions.
- Expanding a role shows its permissions and where each applies.
- Apply every binding in an export; the console finds and manages roles
  through the bindings' labels and annotations.
- Link the OIDC limitation to the Create a role step, and say Entra ID sends
  group IDs.
- Mention the no-identity-provider banner and the Description field.
- US spelling: catalog.
- Move the link on the roles page into the list, without a description.
- Drop the sentences on IdP role subjects not being editable and on a
  deleted IdP role's group staying in the directory.

Calico Enterprise now allows the directory sync to reach the host and port in
the secret's URL, so the URL no longer has to match
Authentication.spec.ldap.host. An in-cluster directory still has to be named
<service>.<namespace>.svc to be reachable.