add env vars and update docs

[jaredfholgate]

This PR adds new alternative environment variable to support Azure DevOps Pipelines when using the azurerm backend.

• AZURESUBSCRIPTION_SERVICE_CONNECTION_ID: This is default env var spat out by the Azure DevOps Azure CLI Task and we want to use this by default if not explicitly supplied.
• ARM_OIDC_AZURE_SERVICE_CONNECTION_ID_BACKEND and ARM_CLIENT_ID_BACKEND: These allow specifying an alternative service connection and client ID that the backend will use.

This opens up the possibility of using separate identities for state and provider with OIDC auth. It is possible in limited scenarios by using CLI flags, but because they are persisted to the plan file it breaks some scenarios of separate identity for plan and apply.

With these environment variable we should be able to support with env vars, which is not possible now:

• Init: Identity 1
• Plan: Identity 2 - read only (with Identity 1 for state)
• Init: Identity 1
• Apply: Identity 3 - read / write (with Identity 1 for state)

There is also an update to the backend docs to specify the least privilege role assignment required following testing.

Fixes: https://github.com/hashicorp/terraform/issues/34322#issuecomment-2324796855 - There is a specific ask around using a separate credential for backend.

Target Release

1.12.x

CHANGELOG entry

• [x] This change is user-facing and I added a changelog entry.
• [ ] This change is not user-facing.

[jaredfholgate]

@jackofallops I added one further docs fix I spotted in here, but it is ready to go as far as I am concerned. There are no breaking changes in here. Would be great to get this in.

[SC-Tobias]

Sorry for the bump, but is there any ETA on when this might be merged? I'd love to see this implemented in Terraform, as we want to use separate credentials for the backend since our state is located in a different tenant.