feature: split service principal for plan and apply

[jaredfholgate]

Overview/Summary

As per issue #24. This PR is to add an additional user assigned managed identity and isolate permissions for plan and apply. This PR is being done before some of the others as it is a significant refactor and makes sense to do it prior to layering other changes on top.

This change is driven by community asks for 'best practice' around security. This will be combined with a second issue for required templates to demonstrate how to secure a pipeline. We want this accelerator to be consumed by all customers, including those with tight security needs, so adding these features to enable that.

In the future it could also serve as a generic model for secure pipelines with Terraform if we extract it into module(s).

In summary, the initial implementation had:

• 1 User Assigned Managed Identity
  • 2 Federated Credentials (plan and apply) on the same Managed Identity, mapped to to the Environment (GitHub) or Service Connection (Azure DevOps)
• 2 Service Connections for Azure DevOps (plan and apply)
• 2 Environments (plan and apply)

This PR moves the model to:

• 2 User Assigned Managed Identities (plan and apply)
  • Each has it's own federated credential mapped to the Environment (GitHub) or Service Connection (Azure DevOps)
• ⁠2 Service Connections for Azure DevOps (plan and apply)
• 2 Environments (plan and apply)

The .test template has been updated to include creating a management group and a resource group to prove the read and write permissions work as expected.

This PR fixes/adds/changes/removes

1. Feature Request: Support Read Only Service Connection / Service Principal for Plan #24

Breaking Changes

There are no changes to the interface for users of the PowerShell module, all inputs remain the same. Just the deployed resources change.

Testing Evidence

E2E tests will be run as part of this PR.

Manual testing of:

• CI / CD for Apply and Destroy with Management Groups and Resource Groups for:
  • GitHub
  • Azure DevOps WIF
  • Azure DevOps MSI

As part of this Pull Request I have

• Checked for duplicate Pull Requests
• Associated it with relevant issues, for tracking and closure.
• Ensured my code/branch is up-to-date with the latest changes in the main branch
• Performed testing and provided evidence.
• Updated relevant and associated documentation.

[jaredfholgate]

I am merging this as has been tested and required as the basis for the next features