LGTM. These are just thoughts so that I don't forget them:
Seems to me that whenever we need to use the azure sdk we should use an azure resource "client", as they provide the fake pkg to test them etc, e.g use the azure storage module if we manipulate azure storage resources, so we get the client, client factory and fakes from there. AFAIK all of them have an arm client in the client structs?
Observability for operators can get weird when they don't work, not least using webhooks, so we might start to think to create a shared pkg for it that uses mostly traces
Description
Backend crd for managing and configuring APIM backends
Related Issue(s)
1020
Verification
Documentation