Clarify SPNs, Least Privilege, and environments for CI/CD

[techlake]

• Refine currently needed RBAC and MS Graph permissions (if any) for read, as well as Policy updates and Roles Updates.
• Simplify SPNs:
  • SPN for tenant wide read to execute Build-DeploymentPlan
  • One SPN per pacEnvironment to execute Deploy-PolicyPlan
  • One SPN per pacEnvironment to execute Deploy-RolesPlan
  • One SPN per pacEnvironment to execute Create-AzRemediationTasks
• Document revised approach
• Investigate using OpenID instead of secrets for SPNs
  • Azure DevOps
  • GitHub Actions

AB#44038

[apybar]

Adding to backlog