Create a user assigned managed identity for each landing zone to assign to AMA agent

### Description

deploying the AMA agent through an azure policy seems like a good idea. However using a system assigned managed identity for the AMA agent will result in a creating one more MI for each VM in the sub therefore it is advised to leverage one user assigned managed identity per subscription : (https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal)

#### Describe the solution you'd like

It would be really useful to create these user assigned managed identity (with **Virtual Machine Contributor**, **Azure Connected Machine Resource Administrator**, **Monitoring Contributor**, **Log Analytics Contributor** roles ) at the same time as the landing zone so that it can be referenced in the policy assignment for the AMA agent deployment later on.

Start by inspecting how the landing zone is created and where Azure Policy assignments are defined. Use the linked Azure Monitor Agent managed identity guidance to confirm the intended identity and role assignments. Done means each subscription receives one user-assigned identity with the four requested roles and that identity can be referenced by the later AMA policy assignment.

Written by the indexing model from the issue text.