origin: Some rolebindingrestrictions cannot be storage migrated because of a missing namespace

From a prod dataset being tested in #14999. Migration being run on some role binding restrictions is failing.

error:     -n AAA rolebindingrestrictions/match-project-admin-user: namespaces "AAA" not found
error:     -n BBB rolebindingrestrictions/match-project-admin-user: namespaces "BBB" not found

First, this means that something in the update path is checking for namespace existence on these RBRs. However, if the namespace isn’t being changed during an RBR, it shouldn’t be checked. That’s probably the minimal bug that needs to be fixed here.

However, if the namespace doesn’t exist, why is the RBR blocking? RBR shouldn’t require a namespace to exist in order to mutate it, unless permission checks are required, and if permission checks ARE required, then it needs to be cleaned up prior to deletion, which it apparently was not.

Would like an answer before we deploy 3.6 to a prod env on Wednesday

@jupierce @Miciah