Consider automating adding security group to Remote Desktop Users group

When using hub session hosts to remote into spoke research VMs, the users signing into the research VMs must be Administrators or members of the Remote Desktop Users group.

- [ ] If using Active Directory as the logon type, use a Custom Script Extension on the research VM spoke service module to add a specified AD group (or individual user) to that security group.
- [ ] Research how to enable Entra ID users to sign in.

(Note, this is NOT the same as #56)

Start with the research VM spoke service module and its Custom Script Extension configuration. Determine how an AD group or individual user could be added to Remote Desktop Users, then research the Entra ID sign-in path. Done means the supported AD automation and Entra ID approach are defined without conflating this work with #56.

Written by the indexing model from the issue text.