Azure AuthZ/Single Resource Group Work - EXE

[cmperro]

This PR includes AuthZ cleanup for Azure. From a high level, you can expect this PR to cover

• Reworking the AD App / Credential to optionally use a custom role OR the built in Contributor role
• Reworking the AD App / Credential to optionally be scoped to a single resource group or the subscription
• Remove the layering of IAM for the AD App (was originally Owner at the subscription and then had the custom role applied at the rg level)
• Add defaults for the custom role / built in selection - defaults to built in role
• Add defaults for scoping of single resource group or subscription - defaults to subcription
• Add functionality to remove credential from CDP (Azure)
• Add functionality to remove AD App from Azure
• Add functionality to remove custom role for AD App

This PR also includes adding the ability to create a CDP environment in a single resource group. This defaults to False / not creating an environment in a single resource group.

NB: If you scope the credential to a single resource group, we will automatically create the CDP environment in a single resource group (regardless of what the parameter is set to).

This PR should be done in conjunction with a CLOUD PR: cloudera.cloud/43

[Chaffelson]

Tested default deployment and single resource group. LGTM

[wmudge]

Needs a rebase onto devel