Azure RBAC using AD groups

[jreadey]

Support the use of AD groups for RBAC rather than relying on group list managed by the server.

[jreadey]

Changes to support this are checked in here: 729d39d.
Summary, the authentication code looks at the "roles" claim in the bearer token and basis the username's group membership based on that.

On the client side, the roles are not generated strictly based on the AD group membership, but by using "App Roles". See: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps. It's easy enough to assign a role based on a AAD group and more flexible than attempting to use the group directly.

[jreadey]

This should be working in master now.