Test resource creation for developer playground should add engsys as owners

We had an instance where a credential was leaked for a service principal which had access to our developer playground subscription. Whilst we were effectively able to disable the access of the service principal, we were not able to immediately rotate the credential because no-one on the EngSys team had ownership rights over the service principal.

The service principal was created by our test resource creation script when no test service principal credentials are supplied. So it creates a new one where the owner is set to the developer that ran the script. This is fine, but we should also amend this script so that the freshly minted service principal also lists the EngSys team as an administrator so that we can go in and rotate the credentials if the developer who owns it is not available.

In addition we should determine whether we want the service principal that is created locally by developers to be granted access at the subscription level or not. It may be better to grant access just to the resource group that is being created and then allow the developer to grant additional rights if it is required. This would reduce the blast radius in the event of a credential leak.