class ClusterRoleBinding

A ClusterRoleBinding that wires a ClusterRole to a ServiceAccount. Mirrors RoleBinding:

ClusterRoleBinding.new(role: MyClusterRole, service_account: MyServiceAccount)

The subject namespace comes from the ServiceAccount when it has one, and is otherwise left blank for the SetNamespace middleware to fill -- ClusterRoleBinding is cluster-scoped, so there is no metadata.namespace to copy from, but the middleware fills binding subjects directly.