Granular Permissions for App Registration

[jofultz]

The initial pass creates an App Registration with Subscription Contributor permissions. We need to narrow down the permissions needed and possibly assign them after Resource Group creation so that the permissions may be scoped to the Resource Group.

Dependency #1

[jofultz]

Tagging Pri2 to indicate that this should happen when we focus on automation without an interactive user.