[DRAFT] [ARO-22413] Remove use of local FP Authorizer to fix int env

[mrWinston]

Which issue this PR addresses:

Fixes ARO-22413

What this PR does / why we need it:

• Bringing back int means we'll need to have the INT RP create clusters in a separate, RH-owned int subscription
• This requires the use of a "mock" FP principal to grant the int RP access to the separate subscription.
• The new "mock" FP principal however would node be able to access the RPs subscription, only the "remote" subscription where clusters are created
• This means, we need to replace all uses of the FP credential in the local subscription with the MSI credentials which the RP already uses

Changes:

• Replace all uses of localFPAuthorizer with the MSIAuthorizer
• Grant the RPs MSI all permissions previously granted to the Local FP
• Related PR in sdp-pipelines grants additional permissions to rp msi: https://msazure.visualstudio.com/AzureRedHatOpenShift/_git/sdp-pipelines/pullrequest/14640053?_a=files

Test plan for issue:

• Currently testing in int
• will require canary deployment to make sure other environments are not affected by the change

Is there any documentation that needs to be updated for this PR?

• tbd

How do you know this will function as expected in production?

• tbd

[github-actions]

Please rebase pull request.

[tuxerrante]

Could we confirm RP managed identity already has equivalent data-plane access on the cluster Key Vault (secrets + certificates)? This switches those clients from FP cert credentials to MSI, and missing KV permissions would show up as runtime 403s after deploy. Context:

ARO-RP/pkg/env/prod.go

Lines 168 to 176 in a518ae3

	clusterKeyvaultURI := azsecrets.URI(p, ClusterKeyvaultSuffix, keyVaultPrefix)
	clusterKeyvaultClient, err := azsecrets.NewClient(clusterKeyvaultURI, msiCredential, p.Environment().AzureClientOptions())
	if err != nil {
	return nil, fmt.Errorf("cannot create key vault secrets client: %w", err)
	}
	p.clusterKeyvault = clusterKeyvaultClient
	clusterCertificatesClient, err := azcertificates.NewClient(clusterKeyvaultURI, msiCredential, p.Environment().AzureClientOptions())
	if err != nil {