Umbrella: ensure `--subscription` argument works across tenants for all commands

**Is your feature request related to a problem? Please describe.**

Many thanks for introducing a much-wanted `--subscription` global argument for all commands! It works **most** of the times :)

However, I keep discovering it does not work for some commands when subscriptions have different tenants. The results are confusing and frustrating to a point that now I am updating all our scripts to fail if target subscription as shown by `az account show` does not match value of `--subscription` argument. Which defies the whole point of this much-wanted feature!

**Describe the solution you'd like**

All commands should work correctly with `--subscription` arg across tenants in the following scenario:

- `SUB_A, TENANT_A`
- `SUB_B, TENANT_B`
- `az set account --subscription=SUB_A`
- `az --subscription=SUB_B [command]`
- expect correct execution

**Additional context**

I'm opening this as an umbrella tracker issue as I feel it might be more appropriate for the teams responsible for individual commands to introduce the tests for `--subscription` arg across tenants and just make sure things work rather than for me and others keep discovering these and open individual issues. Equally this might be a gloabl issue related to how `--subscription` arg was implemented so may be appropriate to investigate and track separately.

So far the issues discovered by me and confirmed to be tenant-related are:

- `az ad sp create-for-rbac`: https://github.com/Azure/azure-cli/issues/7901
- `az acr login`: https://github.com/Azure/azure-cli/issues/7649
- `az keyvault create`: https://github.com/Azure/azure-cli/issues/7607

Other possibly tenant-related issues discovered by me:

- `az role assignment list`: https://github.com/Azure/azure-cli/issues/7650

Within same tenant, but still does not work:

- `az lab vm create`: https://github.com/Azure/azure-cli/issues/7905