Putting this in as a potential design after some more thinking about our discussion in #2372

This manages more or less the same functionality as there is for AWS and GCP with assuming identities, but because Azure requires you have a Client ID to do a token exchange you still have to get it for a target identity somehow.

This proposes we simply ask that operators deploying Kargo put managed identities into a dedicated resource group, grant the Kargo identity RBAC permissions to read managed identities in the resource group (either using the built in Reader role or creating a more restrictive one that only has the Microsoft.ManagedIdentities/Read action). From there, operators would created User-assigned Managed Identities inside this resource group with a name "kargo-{project}" (like AWS IAM roles), and then configure them with Federated identities for the Kargo controller identity.

If Kargo is able to get an identity with the right name in this resource group it will attempt to "impersonate" it (standard token exchange), otherwise it falls back to the controller identity.