Patch the subjects array of an existing ClusterRoleBinding

Kubernetes applies the same escalation check as CREATE, requiring bind on the referenced ClusterRole or already holding all its permissions

Useful for maintenance if you already hold bind.

It is not an independent bypass of the escalation check