Governance module add support PIM

[linus-lysell]

The subscription owner group gets assigned to the subscription when we run the governance module. That is great but we also need to support PIM and just in time access.

Could we create a new group that we call something like: az-sub-lzms-prod-owner-pim. but don't assign it to the subscription. Instead configure PIM that that group is eligible for the subscription using the new group.

We should be able to keep all the existing groups and this shouldn't bee a breaking change. We might need to check if the AAD got a high enough license so we can use PIM. If that is not easy we can use a global variable.