policycontroller: one dangling roleRef drops the rest of a service account's bindings

I tried VisitRulesFor with two ClusterRoleBindings for the same service account, one pointing at a ClusterRole that doesn't exist and one at a real one, and the access object came back with no rules at all. GetRoleReferenceRules returns an error for the missing role and the loop returns right there (reconcile.go#L589-L593), so every binding after it is skipped. The RoleBinding loop below does the same at L612-L616. Upstream Kubernetes hands that error to the visitor and carries on with the rest of the bindings.

So one stale binding quietly strips a service account of access it should still have on the edge. I checked it at master d062d298 with a unit test against the fake client, and the log line was "failed to get rules for clusterrolebinding dangling".