feat: add PAC Repository CR for tektoncd/chains

[ab-ghosh]

Changes

Add Pipelines-as-Code Repository CR for tektoncd/chains with:

• releases-chains namespace for PipelineRun execution
• Release ServiceAccount and RBAC for Tekton Chains signing checks
• Incoming webhook configuration for patch releases (release-v* branches)
• Dashboard namespace allowlist and RBAC rolebindings

This enables PAC to run release PipelineRuns defined in tektoncd/chains's .tekton/ directory.

Part-of: #58

/kind feature

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide
for more details.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign alangreene after the PR has been reviewed.
You can assign the PR to them by writing /assign @alangreene in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment