fix(scripts): compare ClusterRole rules by API group, resource and verb in the drift check

[tim-thacker-nullify]

scripts/check_iam_policy_drift.py compared ClusterRole rules by resource name only, so a kind moved to the wrong API group (e.g. gateways under networking.istio.io instead of gateway.networking.k8s.io) passed.

• Compare ClusterRole rules as (API group, resource, verb) triples, and fail on a rule the parser cannot read.
• Fix the Helm comparison's mismatch message, which said "CloudFormation".
• Correct the Terraform README "Kinds read" cell, which predated the current kind list.

Proposed grants for mesh, Gateway API and network-policy CRDs are held back until the collector lists those kinds; granting permissions nothing calls widens customer access for no gain.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}