[CustomScript] Support SAS tokens for scripts

It would be nice if the custom script extension accepted SAS tokens instead of forcing me to send the full storage account key (effectively giving the VM root access to the storage account); it would better fit the principle of least privilege.

The current issue is that my SAS key would be visible to anyone looking at a deployment log. This means the extension should accept the fileUris parameter in protected settings.