How can I add the permission to use ephemeral containers to a project/namespace role template? See https://github.com/kubernetes/kubernetes/issues/120909