Add read-only service account and namespace-scoped RBAC guides (#2110)