Update calico to 3.13.3 (#6061)

roles/network_plugin/canal/templates/canal-cr-calico.yml.j2

@@ -5,79 +5,34 @@ metadata:
   name: calico
   namespace: kube-system
 rules:
-  - apiGroups: [""]
-    resources:
-      - namespaces
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups: [""]
-    resources:
-      - pods/status
-    verbs:
-      - update
   - apiGroups: [""]
     resources:
       - pods
+      - nodes
+      - namespaces
+      - configmaps
     verbs:
       - get
-      - list
-      - watch
   - apiGroups: [""]
     resources:
-      - nodes
+      - endpoints
+      - services
     verbs:
-      - get
-      - list
-      - update
       - watch
-  - apiGroups: ["extensions"]
-    resources:
-      - thirdpartyresources
-    verbs:
-      - create
-      - get
       - list
-      - watch
-  - apiGroups: ["extensions"]
+  - apiGroups: [""]
     resources:
-      - networkpolicies
+      - nodes/status
     verbs:
-      - get
-      - list
-      - watch
-  - apiGroups: ["projectcalico.org"]
-    resources:
-      - globalbgppeers
-    verbs:
-      - get
-      - list
-  - apiGroups: ["projectcalico.org"]
-    resources:
-      - globalconfigs
-      - globalbgpconfigs
-    verbs:
-      - create
-      - get
-      - list
-      - update
-      - watch
-  - apiGroups: ["projectcalico.org"]
-    resources:
-      - ippools
-    verbs:
-      - create
-      - get
-      - list
-      - update
-      - watch
-  - apiGroups: ["alpha.projectcalico.org"]
-    resources:
-      - systemnetworkpolicies
-    verbs:
-      - get
-      - list
+      - patch
+  - apiGroups:
+    - policy
+    resourceNames:
+    - privileged
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use
   - apiGroups:
     - policy
     resourceNames: