[ci skip] fix MySQL cluster RBAC, Kyverno policy bugs, Nextcloud memory

- dbaas: add mysql-sidecar-extra ClusterRole for namespaces/CRD
  list/watch needed by kopf framework in sidecar containers
- kyverno: restrict inject-priority-class-from-tier to CREATE
  operations only (was blocking pod patches with immutable spec error)
- kyverno: add resource-governance/custom-limitrange label opt-out
  to LimitRange generation policy (mirrors existing custom-quota)
- nextcloud: bump memory limit 4Gi -> 6Gi, add custom LimitRange
  with 8Gi max, opt out of Kyverno-managed LimitRange

stacks/nextcloud/chart_values.yaml

@@ -64,7 +64,7 @@ collabora:
 resources:
   limits:
     cpu: "2"
-    memory: 4Gi
+    memory: 6Gi
   requests:
     cpu: 100m
     memory: 1Gi