Limit visibility of `<Pool>.Status.Capacity / Allocatable`

[adracus]

Summary

Currently, each user that can get / list a pool can see its Status.Capacity / Status.Allocatable. Since this is potentially confidential information, we should enable hiding the field for users without the <pool>/stats permission.

Example

For a MachinePool, if a user doesn't have the RBAC machinepools/stats permission, the machine pool status should not include Capacity / Allocatable. If the user has this permission, the fields should be included.