[PREVIEW] [DO NOT MERGE] Migrate from AAD Pod Identity to Workload Identity (Supported by User Managed Identities)

[ckittel]

This is a PREVIEW of the changes that will be coming to the AKS baseline to support the new user-managed identity support for federated credentials + workload identity in AKS. This PR WILL NOT BE MERGED until these features are in public preview. But you're welcome to explore the changes and get a sense of how the shift will look.