Fix invalid K8s resource names for read_only/product_manager consumer groups

metadata.name must be an RFC 1123 subdomain (no underscores); spec.name
(the value actually matched against the JWT role claim) stays read_only/
product_manager to match the realm role names exactly.

kong/mcp/consumergroups.yaml

@@ -13,7 +13,7 @@ spec:
 apiVersion: configuration.konghq.com/v1beta1
 kind: KongConsumerGroup
 metadata:
-  name: ${NAME}-read_only
+  name: ${NAME}-read-only
   namespace: ${NAMESPACE}
 spec:
   controlPlaneRef:
@@ -25,7 +25,7 @@ spec:
 apiVersion: configuration.konghq.com/v1beta1
 kind: KongConsumerGroup
 metadata:
-  name: ${NAME}-product_manager
+  name: ${NAME}-product-manager
   namespace: ${NAMESPACE}
 spec:
   controlPlaneRef: