Allow direct listing of all permissions and denials for a principal (AAD group, service principal, etc)

**Is your feature request related to a problem? Please describe.**

With more complex security situations where custom roles need to be created, it becomes very difficult to understand the entire graph of permissions that a principal has.

This should be possible via a simple AZ CLI command since it is a fundamental need: to clearly understand what all users / principals are able to do.

**Describe the solution you'd like**

I wish there were an AZ CLI command like:

```
❯ az aad permissions list --query "[?principalName==''].roleDefinitionName"
```

which looks up the list of roles that a particular principal (AAD group, service principal, etc) has, looks up all of the permissions associated with those roles, and analyzes the set to see how the collection of rights should be merged.

**Describe alternatives you've considered**

I have a solution, but it is far too time-consuming and error-prone for my liking.

**First, find all the roles that a principal has:**

```
❯ az role assignment list --query "[?principalName==''].roleDefinitionName"
[
"Project Contributor",
"User Access Administrator",
"Subnet Deleter",
"Storage Blob Data Contributor"
]
```

**Then iterate through these roles:**

Iterate so that I can get the actual permissions from them. Below is an example using the _Storage Blob Data Contributor_ role.

```
❯ az role definition list --query "[?roleName=='Storage Blob Data Contributor']"
[
{
"assignableScopes": [
"/"
],
"description": "Allows for read, write and delete access to Azure Storage blob containers and data",
"id": "/subscriptions/e26acd7c-cb75-4b1c-adf6-07a8eaca6d35/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe",
"name": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
"permissions": [
{
"actions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
],
"dataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
],
"notActions": [],
"notDataActions": []
}
],
"roleName": "Storage Blob Data Contributor",
"roleType": "BuiltInRole",
"type": "Microsoft.Authorization/roleDefinitions"
}
]
```

Then I can collect all of these roles in some sort of set intersection process, which is harder than it sounds, since I need to consider how "actions" and "not actions" interact with each other.

**Additional context**

I initially assumed there was such a command, but that I could not find it in the documentation. I created a [stack overflow question](https://stackoverflow.com/q/68098722/534238) to ask, but the only response that I received is that no such command exists.