Use built in Azure role to reduce required permissions for terraform

[ots22]

This PR removes the requirement for the user applying the terraform configuration to have the Microsoft.Authorization/roleDefinitions/write permission.

The aim is to make it possible to run terraform as a user with minimal additional permissions over those of a Contributer (and ideally less than a full Administrator).

Currently, running the terraform configuration requires the following permissions that a 'Contributor' does not already have:

• Microsoft.Authorization/roleAssignments/write (and maybe delete)
• Microsoft.Authorization/roleDefinitions/write (and maybe delete)

A Role Based Access Administrator has the first of these, but still would not be able to create a custom role. It can be further limited by a condition.

The "app_data_read" role is equivalent to the built-in role "Storage Blob Data Reader", except for the former's limited scope, so one solution is to use this to avoid needing roleDefinitions/write. The scope is specified when the role is applied, so the permission granted to the app is the same.

To do

• Check that the terraform generates the expected plan
• Check terraform apply (I'm unable to do this currently as I am only a Contributor to the subscription I have access to)