Add CLI tool for setting up OIDC URL in unmanaged clusters

```
* Setup a storage account
* Create discovery json and upload to .well-known/openid-configuration
* Create keys json and upload to openid/v1/jwks
* E2E testing (pre-release for the tool)
* Unit test coverage
* Document command usage
* This is mostly for unmanaged clusters (AKS-engine)/CAPZ

* Handle rotation of signing key
* Appending the new key to jwks
* Removing the new key from jwks after 24h
```

Start by locating the proposed CLI entry point and the existing OIDC, storage-account, AKS-engine, or CAPZ integration areas. Define the command's setup and signing-key rotation behavior from the checklist, then add unit and E2E coverage and document command usage. Done means unmanaged clusters can publish the discovery and JWKS documents and rotate keys safely.

Written by the indexing model from the issue text.