Add RBAC support for canal (#1604)

Refactored how rbac_enabled is set
Added RBAC to ubuntu-canal-ha CI job
Added rbac for calico policy controller

roles/kubernetes-apps/policy_controller/calico/templates/calico-policy-controller.yml.j2

@@ -15,15 +15,18 @@ spec:
   template:
     metadata:
       name: calico-policy-controller
-      namespace: {{system_namespace}}
+      namespace: {{ system_namespace }}
       labels:
         kubernetes.io/cluster-service: "true"
         k8s-app: calico-policy
     spec:
       hostNetwork: true
+{% if rbac_enabled %}
+      serviceAccountName: calico-policy-controller
+{% endif %}
       tolerations:
-       - effect: NoSchedule
-         operator: Exists
+        - effect: NoSchedule
+          operator: Exists
       containers:
         - name: calico-policy-controller
           image: {{ calico_policy_image_repo }}:{{ calico_policy_image_tag }}