rg-devops-iac: optionally provision a user-assigned managed identity for MSI-mode sandbox applies #797

Sub-issue of #173.

Problem

arm_auth_mode = "msi" in the root sandbox (#496, PR #743) requires a user-assigned managed identity that is attached to the Terraform execution environment and already holds:

1. Azure RBAC Owner at subscription scope.
2. The Microsoft Graph Group.ReadWrite.All application permission (only needed when enable_module_mssql = true, for azuread_group.sql_admins).

extras/configurations/rg-devops-iac provisions only a system-assigned identity on jumplinux2, which holds just Key Vault Secrets User and Storage Blob Data Contributor. The VM identity block is hardcoded to SystemAssigned, so attaching a user-assigned identity out of band would be reverted by the next rg-devops-iac apply. This blocks the first end-to-end CD run on the self-hosted runner.

Proposed change

• Add an opt-in enable_user_assigned_identity variable (default false) to rg-devops-iac.
• When enabled: create an azurerm_user_assigned_identity (named by module.naming), assign it Owner at the subscription scope, and attach it to jumplinux2 in addition to the existing system-assigned identity, which stays the default identity for az login --identity, cloud-init, the runner script and the azurerm state backend.
• Expose the identity in resource_ids / resource_names and add a user_assigned_identity_client_id output for arm_client_id in MSI mode.
• Document the Microsoft Graph Group.ReadWrite.All grant as a manual admin step, since it requires a Global Administrator or Privileged Role Administrator and cannot be performed by the deploying service principal.

This is the standing-Owner option (Option A) from #173; PIM just-in-time elevation (#500) stays a later enhancement.