feat: optional scheduled permission repair for postgres database resources

[tkcontiant]

Adds optional scheduled permission repair for Postgres resources to restore missing reader/writer access after database adoption or manual permission changes.

• Supports five-field cron schedules in UTC, with a maintenance window and execution timeout.
• Repairs grants across configured schemas, covering tables, views, partitions, sequences, functions, procedures, types/domains, and owner-managed large objects.
• Configures default privileges for future objects created by the stable owner role.
• Uses transactions, rollback, and advisory locking to prevent overlapping repairs.
• Records scheduling, attempts, successes, and errors in CR status. Expired windows are skipped; failed attempts wait until the next scheduled occurrence.
  Repair is additive: existing custom grants, ownership, and credentials are preserved. Scheduling is disabled unless configured.

Omitting the entire permissionRepair field disables scheduled repair.

spec:
  permissionRepair:
    schedule: "0 2 * * *"
    windowDuration: "30m"
    timeout: "5m"

Updates CRDs, examples, documentation, and CI. Tests cover scheduling, UTC behavior, restart handling, duplicate prevention, privilege recovery, default privileges, and rollback.
Validated with race-enabled Go tests, go vet, go build, and PostgreSQL 16/18 integration tests.