[Enhancement Proposal] Support "bring your own access token"

**Is your feature request related to a problem? Please describe.**

We have received several feature requests that the user would like to provide their own access token, without interacting with AAD.

Azure PowerShell cmdlet [`Connect-AzAccount`](https://docs.microsoft.com/en-us/powershell/module/az.accounts/connect-azaccount) supports `-AccessToken`.

**Describe the solution you'd like**

1. `az login` should support either
- `--access-token` argument which accepts an access token with [Subscriptions - List](https://docs.microsoft.com/en-us/rest/api/resources/subscriptions/list) permission:
```
az login --access-token
```
- both `--access-token` (may not have [Subscriptions - List](https://docs.microsoft.com/en-us/rest/api/resources/subscriptions/list) permission) and `--subscription` which explicitly specifies the default subscription (also see #14933):
```
az login --access-token --subscription
```

2. Each `az` command should support a global argument `--access-token` which can be used together with `--subscription` to invoke ARM request:
```
az group list --access-token --subscription
```
I previously made a prototype: https://github.com/jiasli/azure-cli/pull/12

3. Consume an environment variable `AZURE_CLI_ACCESS_TOKEN` so that all commands can use the same access token:
```
export AZURE_CLI_ACCESS_TOKEN=
az group list
```
Also, since environment variables are preserved in memory, is it much safer than saving the access token to hard disk. Also see https://github.com/Azure/azure-cli/issues/10241