Assign users Azure ML and prevent the deployment of compute other than via TRE API

[marrobi]

Description

As a TRE Administrator
I want Workspace Researchers to be automatically granted access to Azure ML
So that they can access the workspace without configuration in Azure

As a TRE Administrator
I do not want AML Users to be able to create compute outside of that enabled via TRE user resources
So that compute is incorrectly configured allowing data exfiltration

This will likely need a group creating for each application role and that group assigning to an Azure ML RBAC role.

Or alternatively a script as part of the bundle that reads assigned users to the application role and grants them access to Azure ML. This will need to be "refreshed" via a custom action.

[marrobi]

@LizaShak @anatbal I could do with passing the output of _get_batch_users_by_role_assignments_body to the resource processor so the AML bundle can assign AML roles to the principal Ids.

What approach would you take? I know we discussed having APIs returning users for a workspace.

For now I'm going to do it in the bundle with Bash, but that feels messy.