Enforce least priv with the SP that uses KV

[james-garriss]

💡 Summary

The purpose of this issue to better enforce "least priv" for the service principal (SP) that is accessing Key Vault (KV).

This is related to #1502

Motivation and context

Per discussions at the Jan 2025 TEM, the SP used to access KV has more privs than it needs.

Implementation notes

The priv update is done in Entra ID.
The testing should be done with all workflows that use a secret in KV.

Acceptance criteria

How do we know when this work is done?

• The SP that uses KV is following least priv practices.