[Feature Request]: Replace pull default SKR policy from github with MAA Service Discovery API and Policy template

Related command

az keyvault key create --default-cvm-policy

Is your feature request related to a problem? Please describe. Today default CVM SKR Policy is pull from a public Github repo
https://raw.githubusercontent.com/Azure/confidential-computing-cvm/main/cvm_deployment/key/skr-policy.json . This will hit performance issue with the expanding default policy file and also raising security concerns.

Describe the solution you'd like We have decided to replace the current implementation with MAA Service Discovery API to get regional default provider and fill it in the template as following:

{
    "anyOf": [
        {
            "allOf": [
                {
                    "claim": "x-ms-compliance-status",
                    "equals": "azure-compliant-cvm"
                }
            ],
            "authority": "{regional-maa-endpoint}"
        }
    ],
    "version": "1.0.0"
}

The service discovery API from MAA:

GET https://management.azure.com/subscriptions/{your_subscription}/providers/Microsoft.Attestation/Locations/{your_location}/defaultProvider?api-version=2020-10-01

Here is a reference application in Azure Powershell for default provider by location

This REST API is call to ARM, so all that's required is an Azure subscription and an identity (e.g., user, service principal, MSI identity, etc.) with RBAC permissions to access that subscription's resources.

For mooncake, Fairfax, USNAT and USSec the API part /subscriptions/{your_subscription}/providers/Microsoft.Attestation/Locations/{your_location}/defaultProvider?api-version=2020-10-01 remain the same. But the arm endpoint https://management.azure.com/ will be different (see below),

Describe alternatives you've considered NA

Additional context The current implementation in the repo: https://github.com/evelyn-ys/azure-cli/blob/f80e7d293c730547742871957e18eaac0f95cfb4/src/azure-cli/azure/cli/command_modules/keyvault/_validators.py#L29

Azure / azure-cli

[Feature Request]: Replace pull default SKR policy from github with MAA Service Discovery API and Policy template #28720