Create a distinct SP for KV access to enforce least priv.

[james-garriss]

💡 Summary

We are currently using one service principal (SP) for both accessing key vault (KV) and for running the orchestrator.

This is related to #1501

Motivation and context

This enforces least priv.

Implementation notes

Setting up the SPs is done in Entra ID.
The testing should be done with all workflows that use a secret in KV and that run the orchestrator.

Acceptance criteria

How do we know when this work is done?

• The SP that uses KV is following least priv practices.
• The SP that uses the orchestrator is following least priv practices.