Update role assignments and add managed identity support for Application Insights and ACR

[therealjohn]

This pull request updates infrastructure Bicep modules to improve role assignments and permissions for Azure AI and monitoring resources. The main changes include refining how roles are assigned to project managed identities and developers, ensuring least-privilege access, and updating role definitions for container registry tasks.

Role assignments and permissions improvements:

• The ai-project.bicep module now assigns the Azure AI project's managed identity principal ID (projectMIPrincipalId) to the Application Insights resource, enabling more granular permissions management.
• Old role assignments for AI developers and Cognitive Services users at the resource group level are removed, and a new, more appropriate Azure AI User role assignment is created at the project scope. This ensures developers have only the necessary permissions to run agents and call models via the project endpoint.
• The applicationinsights.bicep module introduces an optional projectMIPrincipalId parameter. When provided, it assigns the Log Analytics Reader role to the Foundry Project managed identity, which is required for agent trace evaluations. [1] [2]

Container registry permissions update:

• The container registry role assignment is updated to use the "Container Registry Tasks Contributor" role, allowing for building images with ACR tasks and pushing container images, instead of the previous role.… for Application Insights and ACR