feat: use iam-organization-admin instead of iam-admin in owner role

The iam-admin role includes permissions for platform-level resources
(protectedresources, users) that are not scoped to organizations. The
owner role is an organization-level role and should not grant access to
platform-wide IAM resources.

Switch to iam-organization-admin, which covers only org-scoped IAM
resources: groups, groupmemberships, userinvitations, and policybindings.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: scotwells

config/assignable-organization-roles/roles/datum-cloud-owner.yaml

@@ -14,7 +14,7 @@ spec:
       namespace: datum-cloud
     - name: core-admin
       namespace: milo-system
-    - name: iam-admin
+    - name: iam-organization-admin
       namespace: milo-system
     - name: networking.datumapis.com-admin
       namespace: milo-system