Use V5 ESRP task with backing MI + AKV

[hoyosjs]

This PR moves to using WIF + AKV RBAC to support signing diagnostic files without need of manual cert or secret rotation.

[hoyosjs]

Validated in https://dev.azure.com/dnceng/internal/_build/results?buildId=2457899&view=logs&j=c12ca575-f7e0-56f7-d748-65e7ec322168&t=9e374a1d-1c29-5f22-8afc-9bb96bb6561c

[jkoritzinsky]

With this, could we theoretically move to using the ESRP CLI with managed identity? (To make DAC signing in the VMR easier and to simplify our infra in the repo around signing the dac and embedding it in the single file host)

[dotnet-policy-service]

Tagging subscribers to this area: @hoyosjs
See info in area-owners.md if you want to be subscribed.

[hoyosjs]

With this, could we theoretically move to using the ESRP CLI with managed identity? (To make DAC signing in the VMR easier and to simplify our infra in the repo around signing the dac and embedding it in the single file host)

I still need to check - that requires us to install the cert machine wide. That feels a little wide scoped for the purpose of locking down this account.

[hoyosjs]

/backport to release/9.0-preview5

[github-actions]

Started backporting to release/9.0-preview5: https://github.com/dotnet/runtime/actions/runs/9230551811