fix: make system role assignments work w/ upgrade

[jackfrancis]

Reason for Change:

This PR allows system-assigned identity-configured clusters to work w/ aks-engine upgrade. The Microsoft.Authorization/roleAssignments definition needs to use the computed sub(variables('masterCount'), variables('masterOffset')) solution to inform its copy/loop implementation in order to work w/ the current upgrade implementation, which does one master at a time by using its offset value and a masterCount value of the offset + 1.

Issue Fixed:

Credit Where Due:

Does this change contain code from or inspired by another project?

• No
• Yes

If "Yes," did you notify that project's maintainers and provide attribution?

• No
• Yes

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• tested upgrade from previous version

Notes:

[codecov]

Codecov Report

Merging #4078 (7f8d94f) into master (7fdbef0) will decrease coverage by 0.05%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #4078      +/-   ##
==========================================
- Coverage   73.25%   73.19%   -0.06%     
==========================================
  Files         135      135              
  Lines       20542    20555      +13     
==========================================
- Hits        15048    15046       -2     
- Misses       4521     4539      +18     
+ Partials      973      970       -3     

Impacted Files	Coverage Δ
pkg/engine/systemroleassignments.go	97.95% <100.00%> (ø)
cmd/upgrade.go	37.75% <0.00%> (-1.61%)	⬇️
cmd/deploy.go	60.79% <0.00%> (-0.34%)	⬇️
cmd/scale.go	12.56% <0.00%> (-0.29%)	⬇️
cmd/addpool.go	17.97% <0.00%> (-0.11%)	⬇️
pkg/api/types.go	92.56% <0.00%> (+0.41%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7fdbef0...7f8d94f. Read the comment docs.