Use OIDC creds to deploy

[camertron]

This PR performs deploys using federated OIDC credentials in favor of the existing basic auth-based publish profile. Can confirm it works for prod deploys 👍

See also:

1. Terraform change to create a new service principal (SPN): https://github.com/github/azure-rbac/pull/945
2. Terraform change to give the new SPN access to our subscription: https://github.com/github/azure-rbac/pull/946

[rezrah]

Looks great @camertron, thanks for moving this over ✨. Have you verified this works in staging?

One comment about using secrets for the creds. Even if those values aren't compromising, I think we should mitigate by following the examples in docs verbatim.

[camertron]

Unfortunately this doesn't work in staging yet because the entity_value is explicitly set to production here. I did however test it in production and it's working well. I will be adding support for staging today.

Edit: staging should be working now
Edit 2: Unfortunately entity_value = "*" doesn't work, so I've had to create a separate SPN for staging deploys: https://github.com/github/azure-rbac/pull/953

[camertron]

Had to submit the change in two PRs: https://github.com/github/azure-rbac/pull/970 https://github.com/github/azure-rbac/pull/971, but now everything appears to be working 🎉